Class-action lawsuit filed in response to Hyvee data breach

Posted on 16 October 2019 at 2:31pm

COLUMBIA - A Pennsylvania law firm has filed a class-action lawsuit against Hy-Vee.

The lawsuit comes after the grocery store chain announced a data breach across select stores.

The suit claims more than 5 million of HyVee’s customer’s credit card and debit card information is being, or once was, sold on the dark web.

The Chimicles, Schwartz, Kriner, and Donaldson-Smith law office said in the suit the data breach was the "inevitable result of Hy-Vee’s inadequate data security measures."

A lawyer on the case, Ben Johns, says the suit was filed largely due to the timeframe in which Hy-Vee notified its customers of the breach.

"Sometimes when retailers like this get breached, they will immediately come clean and explain what happened so people who were affected by it aren't kind of strung out on their own and basically told to figure it out on their own, which is what Hy-Vee is doing," Johns said.

Hy-Vee first announced the breach in August while later naming the affected locations on October 3.

Locally, Hy-Vee's Market Grilles and fuel pumps at 3120 W. Broadway and 25 Conley Rd. were impacted by the breach.

Specific time frames vary depending on the location, but the company said the malware was present in fuel pumps from Dec. 14, 2018 to July 29, 2019 and Jan. 15, 2019 to July 29, 2019 for restaurants and drive-thru coffee shops.

Hy-Vee has removed the malware but urged costumers to continue to check their payment card statements for unauthorized activity.

Johns said the "ball is really in [Hy-Vee's] court" at this point in the lawsuit.

The Des Moines Register originally reported that credit and debit card information of some Hy-Vee customers was sold on an Internet site for $17 to $35 a piece in August.

Columbia resident Dustin Murray is named as a plaintiff in the lawsuit.

The suit claims Central Bank notified Murray his debit card was affected by the data breach on September 16 but he has not received any communication from the chain as of the October 3 filing date.

Murray closed his debit card account and was issued a new card, according to the suit.

KOMU 8 News reached out to Hy-Vee to comment on the suit and they said they do not comment on any pending litigations.

Anyone wishing to join the class-action lawsuit may contact the law firm at