A sophisticated security attack occurred at Sprouts Stores between January 25 and January 29, 2013. Hackers used malware (illegal software) planted on Sprouts Farmers Market’s point of sale system, affecting credit card terminals at 19 of the company’s 151 stores.
The hack used the illegal software to attempt to obtain credit card and debit card information (no PIN numbers were taken) used by Sprouts customers when making purchases at the 19 stores.
After a thorough investigation conducted by the company along with a nationally recognized data security firm, it is not known if any accounts were in fact compromised.
The account information that may have been compromised is limited to certain credit card and check/debit card account numbers. No PIN codes were vulnerable to the attack. No social security numbers or dates of birth were included.
Sprouts says it has extensive security measures in place, which include continuous monitoring of our electronic systems for viruses, malware and hacking attempts. The company discovered the intrusion within days of when the breach began and quickly took steps to prevent the illegal software from functioning.
When Sprouts became aware of the attack, it took prompt action to prevent the illegal software from functioning. On their website, Sprouts says that it “takes a proactive approach to its data security procedures. After confirming that the illegal software was no longer functioning, Sprouts engaged a data security firm to strengthen its point of sale procedures and add additional protections for customer information in all of its 151 stores. As one of those additional protections, Sprouts was able to quickly identify and replace the affected credit card terminals. In addition, Sprouts contacted law enforcement.”
Sprouts is working closely with law enforcement, banks and payment card issuers to identify accounts that may have been compromised.
Sprouts believes that certain credit card and debit card numbers but not PIN numbers used at the 19 stores affected by the illegal software may have been acquired by unauthorized third parties, but at this point is unable to confirm whether accounts were, in fact, compromised.
If payment card information was successfully taken, it is possible that those account numbers may be used for fraudulent purchases, which is why it is so important to carefully monitor your account statement. Sprouts is working with law enforcement and the credit card companies involved to determine if accounts are were affected and, if so, which accounts those are.
It is believed that fewer than 2% of customers who used payment cards in Sprouts stores in January were involved in the hack.
• Chandler, AZ (Dobson & Ray) starting 1/25/2013 and ending 1/29/2013
• Mesa, AZ (Brown & Gilbert) starting 1/25/2013 and ending 1/29/2013
• Peoria, AZ (83rd Ave. & Thunderbird) starting 1/25/2013 and ending 1/29/2013
• Phoenix, AZ (19th Ave. & Northern) starting 1/25/2013 and ending 1/29/2013
• Phoenix, AZ (28th St. & Indian School) starting 1/25/2013 and ending 1/29/2013
• Glendale, AZ (51st Ave.& Peoria) starting 1/25/2013 and ending 1/29/2013
• Mesa, AZ (Southern & Higley) starting 1/25/2013 and ending 1/29/2013
• Oro Valley, AZ (Oracle & Magee) starting 1/25/2013 and ending 1/29/2013
• Surprise, AZ (West Point Pkwy & Bell) starting 1/26/2013 and ending 1/29/2013
• Avondale, AZ (Dysart & McDowell) starting 1/26/2013 and ending 1/29/2013
• Gilbert, AZ (Val Vista & Williams Field) starting 1/26/2013 and ending 1/29/2013
• Chandler, AZ (Queen Creek & Alma School) starting 1/26/2013 and ending 1/29/2013
• Glendale, AZ (57th Ave. & Bell) starting 1/28/2013 and ending 1/29/2013
• El Cajon, CA (El Cajon & 2nd Street) starting 1/26/2013 and ending 1/29/2013
