Wegmans
Disclosed Jun 30, 20224 years ago3,000,000 affectedSettled
Misconfigured cloud storage exposed 3M+ customers for years; USD 400,000 NY AG
For years Wegmans kept account usernames and passwords, names, emails, addresses and driver's license derived data in misconfigured open cloud storage, affecting more than three million consumers; a researcher alerted it in April 2021. Wegmans paid New York USD 400,000.
What is known
| People affected | 3,000,000 (as reported by the organization) |
|---|---|
| Disclosed | Jun 30, 2022 |
| Attack | Exposed data |
| Data exposed | Credentials and tokens, Names, Emails, Addresses, Government IDs |
| Sector | Retail · US |
| Status | Settled |
| Lawsuit or fine | USD 400,000 NY AG penalty (June 2022) (about $400K) |
Sources
| Source | |
|---|---|
| NY AG: USD 400,000 from Wegmans after data breachag.ny.gov · Regulator | Regulator |
Notices filed
| Where | Filed | People |
|---|---|---|
| Researchtotal | Jun 30, 2022 | 3,000,000 |
History of this record
- 2026-09-25 · added · seed source
First seen 2026-09-25 (Research), confirmed by Research. Record counts are as reported. Not legal advice.