Printer-friendly version Reader Comments

Customers are uneasy, and officials are calling for a review of laws governing privacy and notification.

By DAVID HENCH, Staff Writer April 6, 2008

Lynne Erkkinen's frustration with a data breach at her local Hannaford Bros. supermarket last month wasn't about the amount – a paltry $5 charged to her debit card by a bogus New Jersey company – or even the aggravation of replacing the card.

"One of the worst things for me is there's nothing safe, nothing sacred. Somebody can just scoop money from my checking account," the Yarmouth resident said.

Even as Erkkinen's card was being used fraudulently, a team of 30 information technology specialists and outside security pros was scouring the computer systems at Hannaford headquarters in Scarborough.

The team spent days living on pizza and Peeps, running diagnostic programs and scrutinizing computer code in a frantic push to find out how the information was stolen from a computer system thought to meet the industry's stringent security standards.

In the three weeks since the company announced that 4.2 million credit and debit card numbers were potentially stolen, a more complete picture of the nature, magnitude and impact of the breach has emerged from the company, security specialists, financial institutions and government agencies.

However, much still remains a mystery, in part because of parallel forensic and criminal investigations still under way, as well as corporate secrecy.

It is still not known how many card numbers were used to make fraudulent purchases and how long that danger will exist for those who haven't replaced their cards.

Community outrage over the theft and Hannaford's public response to it will have short- and long-term implications for the chain's business and reputation, but it's unclear to what extent.

The theft is sure to prompt changes in computer security, and the payment-card industry is expected to adjust its requirements for large retailers who accept credit and debit cards.

Maine political leaders also are calling for a review of state and federal laws covering privacy and the need for businesses to notify authorities and the public when personal data is stolen.

"It's clear that as criminals develop new ways to steal personal information and account information that Maine must review how we can increase security and notification," Gov. John Baldacci said in a statement Friday.

FIRST NOTICE

Hannaford learned on Feb. 27 that data thieves had attacked its security system. First Data, the company that handles transactions for Discover and American Express, telephoned to say an unusual number of credit cards were showing fraudulent charges. All the cards had been previously used at Hannaford or grocery chains affiliated with the Scarborough-based chain, such as Sweetbay stores in Florida.

"Sometimes those things are anomalies, and sometimes there's a root cause. It could have been a systems error. It could have been a crime," said Carol Eleazer, spokesperson for Hannaford, who has headed up the communications team following the breach. "In this case, it was a crime."

This was the company's first experience with data theft, she said.

The company called the Secret Service, which launched a criminal probe drawing on experts in academia and the private sector and from the Boston office of the Secret Service Electronic Crimes Task Force.

Meanwhile, nearly all the chain's customers and many financial institutions were oblivious to the crime, continuing to use their credit or debit cards at almost 300 stores to purchase groceries.

On the same day Hannaford learned of the security breach, it also received its most recent seal of approval for meeting the payment card industry's standards for data security.

So even while the store's system was being tested by an outside security assessor, deeply embedded software, unlike any virus previously identified by security companies, was secretly stealing credit and debit card numbers, expiration dates and personal...