Class-action lawsuit filed in response to Hyvee data breach
COLUMBIA - A Pennsylvania law firm has filed a class-action lawsuit against Hy-Vee.
The lawsuit comes after the grocery store chain announced a data breach across select stores.
The suit claims more than 5 million of HyVee’s customer’s credit card and debit card information is being, or once was, sold on the dark web.
The Chimicles, Schwartz, Kriner, and Donaldson-Smith law office said in the suit the data breach was the "inevitable result of Hy-Vee’s inadequate data security measures."
Hy-Vee first announced the breach in August while later naming the affected locations on October 3.
The suit claims the timeline of the company's announcements was inadequate and Hy-Vee "shift[ed] responsibility of dealing with any potential fraud on its customers."
Locally, Hy-Vee's Market Grilles and fuel pumps at 3120 W. Broadway and 25 Conley Rd. were impacted by the breach.
Specific time frames vary depending on the location, but the company said the malware was present in fuel pumps from Dec. 14, 2018 to July 29, 2019 and Jan. 15, 2019 to July 29, 2019 for restaurants and drive-thru coffee shops.
Hy-Vee has removed the malware but urged costumers to continue to check their payment card statements for unauthorized activity.
The Des Moines Register originally reported that credit and debit card information of some Hy-Vee customers was sold on an Internet site for $17 to $35 a piece in August.
Columbia resident Dustin Murray is named as a plaintiff in the lawsuit.
The suit claims Central Bank notified Murray his debit card was affected by the data breach on September 16 but he has not received any communication from the chain as of the October 3 filing date.
Murray closed his debit card account and was issued a new card, according to the suit.
KOMU 8 News has reached out to Hy-Vee to comment on the suit.
Anyone wishing to join the class-action lawsuit may contact the law firm at chimicles.com.
Gloss