Wegmans Penalized For Data Breach In New York

A data breach that exposed customers' personal data is going to cost Wegmans.

Wegmans was fined by New York State around $400,000 in penalties after a data breach that happened in April of 2021.

Get our free mobile app

The data breach was found when a security researcher found that a cloud storage container containing consumers' sensitive information, such as usernames and passwords for Wegman's accounts, customers' names, email addresses, mailing addresses, and drivers' license numbers, was unsecured and open to public access.

In May of 2021, a second cloud storage system was also found to be unsecured and open to public access.

The New York State Attorney General Letita James that Wegmans did not do enough security testing and failed to ensure consumer information was kept private.

Along with the $400,000 fine, Wegmans must not upgrade its cybersecurity to prevent future data breaches.

Wegmans' released this statement after the fine was announced.

"Wegmans takes security of customer information very seriously and immediately remedied the situation once it was discovered. We have improved our processes to better protect customer information in the future. While we do not agree with some of the conclusions drawn by the attorney general, we cooperated fully in the investigation and are glad it has been concluded.

This was a configuration issue with two cloud storage containers, and did not involve any other part of the Wegmans network. This type of configuration issue is common, unfortunately, and Wegmans has redoubled its efforts to avoid the issue in the future. There was also no indication that customer data was accessed improperly or otherwise misused. No customer credit card or other sensitive data was involved."

Based in Rochester, New York, Wegmans' has 108 stores in New York, Massachusetts, New Jersey, Pennsylvania, Maryland, Washington, D.C., Virginia, and North Carolina.