Kmart

Disclosed Apr 3, 201316,446 affectedConfirmed

Malware on Kmart in-store payment systems compromises card data

Kmart said malware present on some in-store payment systems since September 2014 compromised customer credit and debit card data, and it was working with law enforcement and forensic investigators.

What is known

People affected	16,446 (as reported to HHS)
Disclosed	Apr 3, 2013
Attack	Hacking
Data exposed	Payment cardsNamesHealth
Sector	Retail · US
Status	Confirmed

Sources

Newsarchive.nytimes.com

Kmart and Dairy Queen Report Data Breach

Official noticemaine.gov

Maine Attorney General breach notice archive: Kmart

Official noticeocrportal.hhs.gov

HHS OCR breach report (archive, resolved): Kmart (Healthcare Provider, IL)

Notices filed

TotalApr 3, 2013

HHS archive12,542 people

TotalFeb 10, 2014

HHS archive16,446 people

TotalSep 10, 2014

HHS archive1,866 people

TotalOct 10, 2014

ResearchCount not stated

Residents of MEMay 19, 2015

Maine AG716 people

History of this record

disclosed2026-09-25

2014-02-10 to 2013-04-03by backfillSource

records2026-09-25

1866 to 16446by backfillSource

disclosed2026-09-25

2014-09-10 to 2014-02-10by backfillSource

data_types2026-09-25

["payment-card","names"] to ["payment-card","names","health"]by backfillSource

records_basis2026-09-25

empty to hhsby backfillSource

records2026-09-25

empty to 1866by backfillSource

disclosed2026-09-25

2014-10-10 to 2014-09-10by backfillSource

source_type2026-09-25

press to officialby backfillSource

source_url2026-09-25

https://archive.nytimes.com/bits.blogs.nytimes.com/2014/10/10/kmart-and-dairy-queen-report-data-breach/ to https://www.maine.gov/ag/sites/maine.gov.ag/files/docs/Data%20breach%20spreadsheet%208-1-2021%20through%2012-5-2018%20REDACTED.xlsxby backfillSource

status2026-09-25

disclosed to confirmedby backfillSource

verified_by2026-09-25

empty to me-agby backfillSource

verified2026-09-25

0 to 1by backfillSource

data_types2026-09-25

["payment-card"] to ["payment-card","names"]by backfillSource

Added2026-09-25

First recordedby seedSource

First seen 2026-09-25 (Research), confirmed by Maine AG. Record counts are as reported. Not legal advice.

Everything about Kmart