SCARBOROUGH, Maine – Authorities say the theft of an estimated 4.2 million account numbers from the Hannaford Bros. supermarket chain was not enough information to enable thieves to access cardholders accounts, meaning the thieves must have been able to match the stolen account numbers to names by another method.
“They must have been obtained the additional information from another source, like a credit bureau or through phishing,” one law enforcement agent on the case told The Credit Union Journal yesterday.
The thieves obtained the account numbers and card expiration dates by hacking into Hannaford’s security system, but that information alone would not enable them to access the accounts said the agent, who did not want to be identified in the ongoing investigation.
So far, approximately 2,000 case of fraud have been attributed to the stolen Hannaford information, but more cases are expected once cardholders start reviewing their transaction records more closely.
Some of the fraud cases have been traced to Brazil, prompting Visa and MasterCard to shut down transactions coming from that area.
“This is obviously a very big operation,” said Chris Daudelin, president of Town & Country FCU, a Portland, Maine-based credit union that is reissuing as many as 12,000 Visa debit cards because of the data breach. “It’s not just one or two people that are trying to hack in to a database. They had to have other resources.”
