Supermarket data breach still unsolved

By Clarke Canfield

updated 7:15 p.m. ET March 18, 2008

PORTLAND, Maine - It was during the card approval process that more than 4 million customer accounts at grocery stores in the Northeast and Florida were exposed to fraud, even though the company meets the latest standards for data security, a spokeswoman said Tuesday.

Hannaford Bros. Co. doesn't yet know how the breach — which began Dec. 7 and ended March 10 — occurred, said Carol Eleazer, vice president of marketing for Hannaford, based in Scarborough.

About 4.2 million credit and debit card numbers were exposed and at least 1,800 stolen during the seconds it takes for that information to travel to credit card companies for approval after customers swiped their cards in checkout-line machines, Eleazer said.

On Tuesday, many customers were not yet aware of the problem. Others who'd read or heard about it didn't seem alarmed.

Shopper Mary Kellett said she'll continue to shop at Hannaford — and use her credit card. She'll also be more vigilant checking her card statements.

"Nobody's really found a perfect a way to prevent this," she said as she loaded bags of groceries into her car in a Hannaford parking lot in Portland. "But I'm still here shopping today."

It's virtually impossible to make credit card transactions 100 percent secure, even if companies use state-of-the-art technology and accepted security practices, said Avishai Wool, chief technical officer at AlgoSec, a computer network security company in Reston, Va.

"That's like asking if you can have a 100-percent secure home that cannot be broken into," Wool said. "I don't think you can. If the bad guys spend enough money and have the appropriate equipment, they can go through anything."

The breach affects all 165 Hannaford stores in New England and New York, 106 Sweetbay stores in Florida and a smaller number of independent stores in the Northeast that sell Hannaford products. Hannaford and Sweetbay are owned by the Belgian supermarket chain Delhaize America.

The Hannaford case is among the largest security breaches on record but is still much smaller than the tens of millions of credit cards that were exposed at TJX Cos. of Framingham, Mass., which has 2,500 stores and includes the T.J. Maxx and Marshalls chains.

Hannaford stores, Eleazer said, do not use wireless systems, which are believed to have been the entry points for other recent large-scale data thefts at retailers, including the TJX case.

MORE FROM SECURITY

Security Section Front

Check your junk mail: Might have a contract in it FTC warns of increase in Internet scams Man indicted in hacking of Palin's e-mail Tiny flash drives improve their security Fake YouTube pages used to spread viruses EU proposes more rights for Internet shoppers Gmail 'Mail Goggles' stymie drunk e-mailing Fraud plagues prepaid calling card market GPS 'spoofing' could threaten national security Chinese snoop on Skype, but are they alone? Security Section Front   Add Security headlines to your news reader: