Kmart
Disclosed Apr 3, 201313 years ago16,446 affectedConfirmed
Malware on Kmart in-store payment systems compromises card data
Kmart said malware present on some in-store payment systems since September 2014 compromised customer credit and debit card data, and it was working with law enforcement and forensic investigators.
What is known
| People affected | 16,446 (as reported to HHS) |
|---|---|
| Disclosed | Apr 3, 2013 |
| Attack | Hacking |
| Data exposed | Payment cards, Names, Health |
| Sector | Retail · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| Kmart and Dairy Queen Report Data Breacharchive.nytimes.com · News | News |
| Maine Attorney General breach notice archive: Kmartmaine.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): Kmart (Healthcare Provider, IL)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| HHS archivetotal | Apr 3, 2013 | 12,542 |
| HHS archivetotal | Feb 10, 2014 | 16,446 |
| HHS archivetotal | Sep 10, 2014 | 1,866 |
| Researchtotal | Oct 10, 2014 | |
| Maine AGresidents of ME | May 19, 2015 | 716 |
History of this record
- 2026-09-25 · disclosed: 2014-02-10 to 2013-04-03 · backfill source
- 2026-09-25 · records: 1866 to 16446 · backfill source
- 2026-09-25 · disclosed: 2014-09-10 to 2014-02-10 · backfill source
- 2026-09-25 · data_types: ["payment-card","names"] to ["payment-card","names","health"] · backfill source
- 2026-09-25 · records_basis: empty to hhs · backfill source
- 2026-09-25 · records: empty to 1866 · backfill source
- 2026-09-25 · disclosed: 2014-10-10 to 2014-09-10 · backfill source
- 2026-09-25 · source_type: press to official · backfill source
- 2026-09-25 · source_url: https://archive.nytimes.com/bits.blogs.nytimes.com/2014/10/10/kmart-and-dairy-queen-report-data-breach/ to https://www.maine.gov/ag/sites/maine.gov.ag/files/docs/Data%20breach%20spreadsheet%208-1-2021%20through%2012-5-2018%20REDACTED.xlsx · backfill source
- 2026-09-25 · status: disclosed to confirmed · backfill source
- 2026-09-25 · verified_by: empty to me-ag · backfill source
- 2026-09-25 · verified: 0 to 1 · backfill source
- 2026-09-25 · data_types: ["payment-card"] to ["payment-card","names"] · backfill source
- 2026-09-25 · added · seed source
First seen 2026-09-25 (Research), confirmed by Maine AG. Record counts are as reported. Not legal advice.