Skip to content
Breaches.

Kroger

Disclosed Jun 18, 20206 years ago1,474,284 affectedConfirmed

Official notice

Accellion FTA breach exposes Kroger associate and pharmacy customer data

Kroger confirmed it was impacted by the Accellion data security incident affecting its third-party secure file transfer service, involving data of some associates and a limited number of customers.

What is known

People affected1,474,284 (as reported to HHS)
DisclosedJun 18, 2020
DiscoveredJan 23, 2021
HappenedDec 24, 2020
AttackSupply chain
Data exposedNames, Social Security numbers, Health, Employment, Financial
SectorRetail · US
StatusConfirmed
Part ofAccellion (2021)

Sources

Source
California Attorney General breach notice: Krogeroag.ca.gov · Official notice
Washington Attorney General breach notice: Krogeratg.wa.gov · Official notice
Accellion Security Incident Impacts Kroger Family of Companies Associates and Limited Number of Customersweb.archive.org · The organization
The Accellion Breach Keeps Getting Worse, and More Expensivewired.com · News
Indiana Attorney General 2021 data breach report: Krogerin.gov · Official notice
HHS OCR breach report (archive, resolved): Kroger (Healthcare Provider, OH)ocrportal.hhs.gov · Official notice

Notices filed

WhereFiledPeople
HHS archivetotalJun 18, 2020132,258
California AGresidents of CAFeb 19, 2021
Washington AGresidents of WAFeb 19, 2021153,800
ResearchtotalFeb 19, 2021
Indiana AGresidents of INFeb 19, 2021208,100
HHS archivetotalFeb 19, 20211,474,284
HHS archivetotalNov 12, 20212,686

Same campaign

OrganizationAffected
QualysQualys customer files taken through Accellion FTA serverMar 4, 20215 years agoSupply chainUnknown
SingtelSingtel customer data stolen through Accellion file sharing systemFeb 11, 20215 years agoSupply chainUnverifiedUnknown
AccellionZero-day attacks on legacy FTA file transfer appliance hit dozens of organizationsFeb 1, 20215 years agoSupply chainUnknown
Australian Securities and Investments CommissionASIC server breached through Accellion file transfer softwareJan 25, 20215 years agoSupply chainUnverifiedUnknown
Reserve Bank of New ZealandFiles illegally downloaded from central bank's Accellion file sharing systemJan 10, 20215 years agoSupply chainUnverifiedUnknown

Other breaches at Kroger

BreachAffected
Disclosed May 16, 2016May 16, 201610 years ago13K
History of this record
  • 2026-09-25 · disclosed: 2021-02-19 to 2020-06-18 · backfill source
  • 2026-09-25 · records_basis: organization to hhs · backfill source
  • 2026-09-25 · records: 1040000 to 1474284 · backfill source
  • 2026-09-25 · source: empty to https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf · backfill source
  • 2026-09-25 · records_basis: empty to organization · backfill source
  • 2026-09-25 · records: empty to 1040000 · backfill source
  • 2026-09-25 · campaign: empty to accellion-2021 · seed source
  • 2026-09-25 · sector: tech to retail · seed source
  • 2026-09-25 · attack: hacking to supply-chain · seed source
  • 2026-09-25 · data_types: [] to ["names","ssn","health","employment","financial"] · seed source
  • 2026-09-25 · summary: empty to Kroger confirmed it was impacted by the Accellion data security incident affecting its third-party secure file transfer service, involving data of some associates and a limited number of customers. · seed source
  • 2026-09-25 · title: empty to Accellion FTA breach exposes Kroger associate and pharmacy customer data · seed source
  • 2026-09-25 · attack: unknown to hacking · backfill source
  • 2026-09-25 · discovered: empty to 2021-01-23 · backfill source
  • 2026-09-25 · added · backfill source

First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.

Everything about Kroger

New breaches by email

Wednesdays, only in weeks with newly disclosed breaches, the largest first.

Double opt-in. Unsubscribe any time.