Hy-Vee released more information about the payment card data breach incident the grocery chain reported in August.
Hy-Vee said in a statement that unauthorized activity on some of its payment systems was detected on July 29, and an investigation into the breach began shortly after. The investigation discovered malware was used to access payment card data from cards used on point-of-sale devices at some Hy-Vee fuel pumps, drive-thru coffee shops, and restaurants.
According to the statement, the timeframes when the data from cards used at the affected locations may have been accessed range from Dec. 14, 2018 to July 29, 2019 for fuel pumps, and Jan. 15, 2019 to July 29, 2019 for restaurants and drive-thru coffee shops.
A list of locations involved and more detailed timeframes is available on Hy-Vee's website.
In addition, Hy-Vee said it will be mailing letters or sending an email to all customers identified as having used their card at a location involved during that location's specific timeframe.
Hy-Vee report back in August that payment card transactions were not involved at the company's front-end checkout lanes, inside convenience stores, pharmacies, customer service counters, wine & spirit locations, floral departments, clinics, and all other food service areas.
Going forward, Hy-Vee said all malware has been removed and enhanced security measures have been added.
Sioux Falls locations that were affected and dates:
- Market Grille, 1601 S Sycamore Ave., 1/15/2019 - 7/29/2019
- Market Grille, 4101 S Louise Ave., 1/15/2019 - 7/22/2019
- Market Grille, 3000 S Minnesota Ave., 1/15/2019 - 7/29/2019
- Market Grille, 1900 S Marion Rd., 1/15/2019 - 7/17/2019
- Market Grille, 3020 E 10th St., 1/15/2019 - 7/17/2019
- Market Grille, 1231 E 57th St., 1/15/2019 - 7/17/2019
- Market Grille, 2700 W 10th St., 1/15/2019 - 7/17/2019
- Pay at the Pump, 4103 S Louise Ave., 12/12/2018 - 7/22/2019
- Pay at the Pump, 3010 S Minnesota Ave., 12/17/2018 - 7/29/2019
- Pay at the Pump, 5201 West 26th St., 12/17/2018 - 7/29/2019
- Pay at the Pump, 3100 E 10th St., 12/14/2018 - 7/28/2019