SCARBOROUGH, Me. - Hundreds of credit unions throughout the East Coast were working last week to reissue both Visa and MasterCards after one of the nation’s largest supermarket chains reported that as many as 4.2 million account numbers had been stolen by hackers.
“We can’t keep dealing with these things every six months,” said a frustrated Gordon Beebe, president of Gloversville, N.Y.–based Fulton County FCU, who was working with staff late into the night to block and reissue 1,100 Visa debit cards.
“This has been a very expensive few days. My entire staff has been doing nothing but fielding customer calls,” said Chris Daudelin, president of Portland’s Town & Country FCU, who plans to reissue about 12,000 Visa debit cards flagged as compromised by the breach.
The breach occurred at Hannaford Bros., which operates 165 supermarkets in the Northeast under its corporate name and 105 Sweetbay grocery stores in Florida, sending credit unions and banks in those regions scurrying to notify members/customers to carefully review their accounts to determine whether their cards had been used for any fraudulent transactions. Officials at those institutions were blocking accounts flagged by their processors or one of the two card companies and reissuing the cards.
In a public statement, Hannaford said as many as 4.2 million credit and debit card numbers were stolen from its database during the card authorization transmission process. The card numbers, however, were not enough to access accounts, leading authorities to conclude that the hackers obtained additional information to match account numbers and PINs from another source, like a credit bureau or from a phishing expedition.
Hannaford Bros. is owned by Belgium-based Delhaize Group, whose Delhaize America Inc. unit also includes Food Lion and other grocery chains.
Jon Paradise, spokesman for the Maine CU League, said he expects credit unions to be forced to replace more than 100,000 cards due to the breach by the state’s largest supermarket chain. “There will be a huge impact. In a lot of communities they’re the only grocery store,” he said.
Other credit unions reporting a reissuance of cards because of the breach were: First New York FCU, in Schenectady; University Credit Union, in Orono, Me.; Maine State Employees CU, in Augusta, which was replacing 6,000 Visa credit and 9,100 Visa debit cards; Capital Communications FCU, in Albany, which is reissuing as many as 14,000 cards. Area banks are expected to replace at least as many cards.
Ironically, the Hannaford Associates FCU, the supermarket chain’s own CU, appears to have been unaffected by the breach. A statement on the CU’s website mentioned the breach but assured members they were not affected.
So far, authorities have detected 1,800 cases of fraud on the identified cards, but more incidents are expected. Many of the fraudulent transactions were originated in Brazil, prompting both MasterCard and Visa to shut down transactions from that area. Town & Country’s Daudelin said they detected transaction attempts from Brazil but were able to block the transactions before they went through.
CU officials, most of whom have gone this route before with TJX, BJ Wholesale, expressed frustration at the secrecy being maintained, as well as the costs they will bear.
John Benoit, president of North Country FCU in Burlington, Vt., said his CU was contacted by its cards processor, Fifth Third Bancorp on March 13. Fifth Third, which also processed cards for TJX, told them they believed the breach occurred at a national retailer but refused to identify the retailer. “Initially, we thought it was only going to be a small portion,” said Benoit, who said his credit union is reissuing 3,000 MasterCard debit cards and 400 Visa credit cards.
Four days later, Hannaford issued a statement identifying itself as the source of the breach. “Hannaford Brothers has stores at all of our locations,” said Benoit, who said his CUn will incur substantial costs to notify its members and to replace the cards. “We know it’s going to be costly.”
Town & Country’s Daudelin said Visa initially notified his credit union on Thursday, March 13 that a breach at an unidentified major retailer had compromised some its cards and flagged 4,000 Visa debit cards. That number was updated after the weekend to as many as 15,000, but 3,000 of the cards were inactive, leaving about 12,000 cards to be replaced. At a cost of around $7 a card, Daudelin predicted the breach would cost his credit union “$50,000 and upwards” to resolve–all costs to be paid without the aid of insurance.
At least two class action lawsuits were filed last week by consumers within days of the news being made public. The suits, filed in federal courts in Portland and Bangor, allege the supermarket chain was negligent in its security.
