Hy-Vee controversies
Controversies tied to this brand in public sources. A listing is not a finding of fault.
Back to profile10 entries
2021
Hy-Vee reaches settlement over customer data breaches
Settlement
Hy-Vee reached a proposed settlement in a lawsuit concerning customer information breaches involving card readers. Under the proposed terms, payments would be made to victims and plaintiffs, and Hy-Vee would be required to spend millions of dollars on data security and employee training. The settlement remained subject to court approval.
Hy-Vee is settling a lawsuit over customer information breaches involving card readers. The proposed settlement includes payments to victims and plaintiffs and requires Hy-Vee to spend millions of dollars on data security and employee training; a court still has to approve it.
Company response
Remediation — Hy-Vee
The settlement also requires Hy-Vee to spend millions of dollars to beef up its data security system and provide employee training on data security.
Source excerpt
The breach took place in 2018 and 2019 when malware infected card readers at Hy-Vee gas pumps and drive-thru coffee shops as well as its Market Grille and Wahlburgers stores.
A court still has to approve the settlement before it can go into effect.
WEST DES MOINES, Iowa - Hy-Vee stores is settling a lawsuit over data breaches of it credit and debit card readers.
2020
Hy-Vee among retailers recalling bagged salads
Recall announced
Aldi, Hy-Vee and Jewel-Osco announced recalls of bagged garden salads amid an investigation into a Cyclospora illness outbreak in the upper Midwest. The affected products included Aldi's Little Salad Bar Brand Garden Salad and Hy-Vee's store-brand Garden Salad.
Company response
Refund or compensation — Hy-Vee
Customers who purchased this product should discard it or return it to their local Hy-Vee store for a full refund.
Refund or compensation — Hy-Vee
Leaders with Hy-Vee say customers who purchased the product should either throw it away or return it to their local Hy-Vee for a refund.
Source excerpt
Both the Aldi and HyVee stores have announced the recall, along with Jewel-Osco stores in Iowa, Illinois, Missouri, Kansas, Nebraska, South Dakota, Minnesota and Wisconsin.
Aldi’s Little Salad Bar Brand Garden Salad and Hyvee’s store brand Garden Salad are the two products being recalled locally.
Two area grocery store chains are recalling their bagged garden salad products after the US Food and Drug Administration and the Centers for Disease Control began investigating an outbreak of the intestinal illness Cyclospora in the upper Midwest.
2020
Hy-Vee recalls bagged garden salad over potential contamination
Recall announced
Hy-Vee recalled its 12 oz. bagged garden salad products across an eight-state region because of potential Cyclospora contamination. Customers were told to discard the product or return it for a full refund.
Company response
Refund or compensation — Hy-Vee
Customers who purchased this product should discard it or return it to their local Hy-Vee store for a full refund.
Source excerpt
The product was distributed to Hy-Vee grocery stores across its eight-state region of Iowa, Illinois, Missouri, Kansas, Nebraska, South Dakota, Minnesota and Wisconsin.
The potential for contamination was brought to Hy-Vee’s attention when Fresh Express, the product's manufacturer, announced that the U.S. Food and Drug Administration and the Centers for Disease Control Prevention have been investigating an outbreak of Cyclospora in the upper Midwest section of the United States.
Hy-Vee is recalling its 12 oz. Hy-Vee Bagged Garden Salad products across an eight-state region due to potential Cyclospora contamination.
2020
Hy-Vee recalls two Short Cuts vegetable mixes
Recall announced
In November 2020, Hy-Vee announced a voluntary recall of two Short Cuts vegetable mix products due to possible contamination with Listeria monocytogenes. The recall covered Hy-Vee's eight-state region. At the time of the announcement, no illnesses had been reported in connection with the recalled products.
Company response
Recall — Hy-Vee
Hy-Vee announced Tuesday that it is voluntarily recalling two of its Hy-Vee Short Cuts vegetable mix products due to possible contamination with Listeria monocytogenes.
Source excerpt
So far, no illnesses have been reported.
The recall covers Hy-Vee's eight-state region, including Kansas and Missouri.
Hy-Vee announced Tuesday that it is voluntarily recalling two of its Hy-Vee Short Cuts vegetable mix products due to possible contamination with Listeria monocytogenes.
2020
Court allows some claims in Hy-Vee data breach lawsuit to proceed
Ruling
A U.S. district court dismissed some claims and allowed others to proceed in a class-action lawsuit against Hy-Vee arising from a 2019 payment-terminal data breach. The plaintiffs alleged negligence, untimely customer notification, contract breaches and deceptive business practices; the ruling did not resolve the claims that proceeded.
Source excerpt
The ruling from the Central District of Illinois is related to a class-action lawsuit brought against Hy-Vee, Inc., by plaintiffs in several states, including Iowa. The action was brought after Hy-Vee revealed in August 2019 a data breach involving payment terminals at its gas pumps, drive-through coffee shops, and store-operated restaurants.
The plaintiffs claim that Hy-Vee was negligent, failed to notify customers in a timely fashion, breached contracts, and engaged in fraudulent or deceptive business practices.
The judge dismissed some claims while allowing others to proceed in the ruling filed on Monday, April 20.
2019
Hy-Vee lists stores affected by data breach
Issue disclosure
In 2019, Hy-Vee made information available on its website identifying stores affected by a recent data breach incident. The published information included locations in Nebraska. The disclosure followed the data breach and provided affected store details to the public through the company's website.
Company response
Ongoing disclosure — Hy-Vee
You can now find out specifically which stores were impacted by visiting Hy-Vee's website.
Source excerpt
Some Nebraska Hy-Vee locations were affected by a recent data breach incident. You can now find out specifically which stores were impacted by visiting Hy-Vee's website.
2019
Hy-Vee identifies malware as cause of payment-card data breach
Issue disclosure
Hy-Vee stated that malware caused a data breach affecting some of its fuel pumps, drive-thru coffee shops, and restaurants. The company said it removed the malware and implemented an enhanced security system. According to Hy-Vee, the malware captured cardholder names, numbers, and verification codes.
Hy-Vee said malware caused a data breach affecting some of its fuel pumps, drive-thru coffee shops, and restaurants. It said it removed the malware and implemented an enhanced security system; the malware captured cardholder names, numbers, and verification codes.
Company response
Remediation — Hy-Vee
The Grocery Chain says it has removed the malware and implemented an enhanced security system.
Source excerpt
The malware captured cardholder names, numbers and verification codes.
The Grocery Chain says it has removed the malware and implemented an enhanced security system.
Hy-Vee says malware is the cause of the data breach at some of its fuel pumps, drive-thru coffee shops, and restaurants.
2019
Hy-Vee releases additional payment-card breach information
Issue disclosure
Hy-Vee provided additional information about a payment-card incident after detecting unauthorized activity on some payment processing systems. Its investigation identified malware designed to access payment-card data at certain fuel pumps, drive-thru coffee shops and restaurants. Hy-Vee said it removed the malware, implemented enhanced security measures and was notifying identifiable affected customers.
Company response
Investigation — Hy-Vee
After detecting unauthorized activity on some of our payment processing systems on July 29, 2019, we immediately began an investigation and leading cyber security firms were engaged to assist.
Remediation — Hy-Vee
During the investigation, we removed the malware and implemented enhanced security measures, and we continue to work with cyber security experts to evaluate additional ways to enhance the security of payment card data.
Ongoing disclosure — Hy-Vee
For those customers Hy-Vee can identify as having used their card at a location involved during that location's specific timeframe and for whom Hy-Vee has a mailing address or email address, Hy-Vee will be mailing them a letter or sending them an email.
Source excerpt
The investigation identified the operation of malware designed to access payment card data from cards used on point-of-sale (“POS”) devices at certain Hy-Vee fuel pumps, drive-thru coffee shops, and restaurants (which include our Hy-Vee Market Grilles, Hy-Vee Market Grille Expresses and the Wahlburgers locations that Hy-Vee owns and operates, as well as the cafeteria at Hy-Vee’s West Des Moines corporate office).
The malware searched for track data (which sometimes has the cardholder name in addition to card number, expiration date, and internal verification code) read from a payment card as it was being routed through the POS device.
2019
Customers file class-action lawsuit against Hy-Vee over data breach
Lawsuit filed
Hy-Vee faced a class-action lawsuit filed in federal court. The suit alleged that the grocery chain failed to share breach details promptly, did not provide affected customers enough assistance, and had inadequate data security measures.
Source excerpt
Two Hy-Vee customers who claim their debit cards were compromised following a data breach have filed suit against the West Des Moines-based supermarket chain, alleging Hy-Vee was negligent.
The lawsuit, filed Tuesday in the U.S. District Court for the Central District of Illinois, alleges the Iowa-based grocery chain did not share details about the breach in a timely manner and did not provide enough assistance to customers who were affected by the breach.
A class-action lawsuit has been filed against Hy-Vee, following a massive data breach that impacted its gas stations, coffee shops, and restaurants.
2019
Hy-Vee discloses malware access to customer card information
Issue disclosure
In a controversy noted in 2019, Hy-Vee disclosed that malware had accessed credit and debit card information belonging to some customers. The disclosure followed the company's discovery of security issues. According to the source, Hy-Vee stated that malware accessed credit and debit card information belonging to some customers after the company discovered security issues. The event concerns the unauthorized access of customer payment card data through malware and the company's subsequent disclosure of the matter.
Hy-Vee disclosed that malware accessed credit and debit card information belonging to some customers after the company discovered security issues.
Source excerpt
After Hy-Vee discovered security issues regarding customer credit and debit card information, the West Des Moines-based grocery store company revealed that malware, also known as malicious software, accessed card information from some customers, according to a news release Thursday.
The grocer, which has seven Sioux Falls locations, said Thursday it conducted an investigation after detecting unauthorized activity on some of its payment processing systems in mid-August.
Hy-Vee has released locations and dates of a security breach that affected several of its locations in 2018 and 2019, asking customers to double-check their payment card statements.