Controversies
Controversies tied to this brand in public sources. A listing is not a finding of fault.
Back to profile1 entries
2019
Hy-Vee releases additional payment-card breach information
Issue disclosure
Hy-Vee provided additional information about a payment-card incident after detecting unauthorized activity on some payment processing systems. Its investigation identified malware designed to access payment-card data at certain fuel pumps, drive-thru coffee shops and restaurants. Hy-Vee said it removed the malware, implemented enhanced security measures and was notifying identifiable affected customers.
Company response
Investigation — Hy-Vee
After detecting unauthorized activity on some of our payment processing systems on July 29, 2019, we immediately began an investigation and leading cyber security firms were engaged to assist.
Remediation — Hy-Vee
During the investigation, we removed the malware and implemented enhanced security measures, and we continue to work with cyber security experts to evaluate additional ways to enhance the security of payment card data.
Ongoing disclosure — Hy-Vee
For those customers Hy-Vee can identify as having used their card at a location involved during that location's specific timeframe and for whom Hy-Vee has a mailing address or email address, Hy-Vee will be mailing them a letter or sending them an email.
Source excerpt
The investigation identified the operation of malware designed to access payment card data from cards used on point-of-sale (“POS”) devices at certain Hy-Vee fuel pumps, drive-thru coffee shops, and restaurants (which include our Hy-Vee Market Grilles, Hy-Vee Market Grille Expresses and the Wahlburgers locations that Hy-Vee owns and operates, as well as the cafeteria at Hy-Vee’s West Des Moines corporate office).
The malware searched for track data (which sometimes has the cardholder name in addition to card number, expiration date, and internal verification code) read from a payment card as it was being routed through the POS device.