Attacks/Breaches
8/15/2014
01:40 PM
Sara Peters
Sara Peters
Quick Hits
Connect Directly
Twitter
RSS
E-Mail
50%
50%

SuperValu Food Stores Reports Network Intrusion

The company is investigating whether data was breached, but it is already offering customers identity theft protection.

SuperValu Inc. has discovered an intrusion into the network that processes transactions at its food and liquor stores across the US. The company has not yet determined whether attackers obtained any cardholder data. So far, it has found no evidence of misuse of such data.

Nevertheless, SuperValu is already offering customers one year of free identity theft protection. The company has also notified law enforcement officials and the credit card brands.

The intrusion occurred between June 22 and July 17. It may have resulted in the theft of credit card account data used in the point-of-sale systems of 180 SuperValu retail stores -- which include Cub Foods, Farm Fresh, Hornbacher's, Shop 'n Save, and Shoppers Food and Pharmacy. It may also affect food store and pharmacy brands that SuperValu recently sold, because SuperValu still provides IT services to them. Those brands include Albertsons, Acme, Jewel-Osco, Shaw's, Star Market, Osco, and Sav-on.

SuperValu has set up a dedicated call center to answer customers' questions about the incident. Customers may call (855) 731-6018 for more.

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
8/19/2014 | 2:41:07 PM
Re: betting on a breach
@Mike, that would definitely be the ideal scenario, but obviously not realistic to do overnight. There are Internet security efforts under way, of course, as well as secure software development initiatives. But it will always be a battle between good and evil. 

That's not to say everyone can't raise the bar more, though. It is frustrating to see the same old, same old, breaches again and again.
mschelin917
50%
50%
mschelin917,
User Rank: Apprentice
8/19/2014 | 2:22:16 PM
Re: betting on a breach
Hello, This is my first time commenting. What do we expect. As an avid reader I see every industry being attacked and breached.  Target didn't start this as attacks have been going on for years.  Folks, my two cents are the following.  It's time to start over.  The internet, software, everything with Security baked in from the ground up. It's to easy to now and patches won't cut it.  I know it's a radical idea but somethings got to change to make it harder for the bad guys. I'm sure there is going to be some of you that will flame me but do you have a better idea?  

 

Mike
voltagesecurity
50%
50%
voltagesecurity,
User Rank: Apprentice
8/18/2014 | 3:12:09 PM
VP Mark Bower's solution to neutralise the risk of malware
As VP Product Management Mark Bower stated, "By now, every retailer is aware of the risks of malware in the POS, the impact, and the simple fact being compliant to PCI doesn't equate to mitigating advanced threats that no doubt again stole the gold in this case. The only way to neutralise the risk of malware in the point of sale (POS) systems is to avoid any sensitive data passing in and through the vulnerable POS or retail IT. Hundreds of thousands of merchants already do this today with proven approaches using the latest innovations in data-centric security and are able to brush off such attacks like water off a duck's back. These risks are totally avoidable – and at a fraction of the cost of the fallout from dealing with the consequences." – Voltage Security
ShermanK906
50%
50%
ShermanK906,
User Rank: Apprentice
8/18/2014 | 2:25:48 PM
Re: another day...
My reaction was, "Wow, only a month had gone by before reporting it."  Most companies seem to wait several months, if they ever report a breach.  But that's a lot of people affected by that breach.
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
8/18/2014 | 9:24:07 AM
Re: another day...
We are continuing to report on this as SuperValu investigates what was exposed or stolen. Stay tuned for more coverage of this latest retail hack.
Bprince
50%
50%
Bprince,
User Rank: Ninja
8/15/2014 | 8:54:45 PM
another day...
another breach. Interesting that a month goes by between the incident and the notification. I wonder when they found out about it and how? 

BP
progman2000
50%
50%
progman2000,
User Rank: Apprentice
8/15/2014 | 4:35:53 PM
Re: betting on a breach
Wow, glad I never stepped foot in a SuperValu.  I have not interest in having to change all of my auto bill pay accounts again because some crummy hacker somewhere may have gotten my Visa number (thank you Target)...
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
8/15/2014 | 3:29:07 PM
betting on a breach
I would be shocked if there wasn't a breach of debit and credit-card data here. Not clear why they are being so cagey and cautious unless they were at risk of being outed about the intrusion, and wanted to get on top of the story. Either way, it's smart for SuperValu to start offering credit monitoring from the get-go.
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-8142
Published: 2014-12-20
Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.36, 5.5.x before 5.5.20, and 5.6.x before 5.6.4 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate keys w...

CVE-2013-4440
Published: 2014-12-19
Password Generator (aka Pwgen) before 2.07 generates weak non-tty passwords, which makes it easier for context-dependent attackers to guess the password via a brute-force attack.

CVE-2013-4442
Published: 2014-12-19
Password Generator (aka Pwgen) before 2.07 uses weak pseudo generated numbers when /dev/urandom is unavailable, which makes it easier for context-dependent attackers to guess the numbers.

CVE-2013-7401
Published: 2014-12-19
The parse_request function in request.c in c-icap 0.2.x allows remote attackers to cause a denial of service (crash) via a URI without a " " or "?" character in an ICAP request, as demonstrated by use of the OPTIONS method.

CVE-2014-2026
Published: 2014-12-19
Cross-site scripting (XSS) vulnerability in the search functionality in United Planet Intrexx Professional before 5.2 Online Update 0905 and 6.x before 6.0 Online Update 10 allows remote attackers to inject arbitrary web script or HTML via the request parameter.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.