<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=us-ascii">
<META content="MSHTML 6.00.6000.16608" name=GENERATOR></HEAD>
<BODY>
<DIV><FONT face=Arial size=2><A
href="http://www.boston.com/business/personalfinance/articles/2008/03/19/state_warns_hannaford_about_laws_on_data_leaks/">http://www.boston.com/business/personalfinance/articles/2008/03/19/state_warns_hannaford_about_laws_on_data_leaks/</A></FONT></DIV>
<DIV>
<P>Massachusetts officials yesterday warned the Hannaford Bros. supermarket
chain that state law requires companies to promptly notify them of security
breaches, following Hannaford's disclosure Monday that a data breach potentially
exposed 4.2 million credit and debit cards to fraud.</P>
<P>The law, adopted last year after a massive hack at Framingham retailer <A
href="http://boston.stockgroup.com/sn_overview.asp?symbol=TJX" target=_new>TJX
Cos.</A>, compels companies to notify the Massachusetts Office of Consumer
Affairs and Business Regulation "as soon as practicable and without unreasonable
delay" after a security breach involving state residents' credit card numbers
and other sensitive personal data. The only exception is when law enforcement
officials request a delay to protect a criminal investigation.</P>
<P>As of yesterday, the consumer affairs office had not received official
notifica tion of the security breach. Hannaford didn't publicly acknowledge the
security lapse until Monday afternoon - after the Massachusetts Bankers
Association issued a press release warning consumers about a major breach at an
unnamed retail chain.</P>
<P>The company, based in Maine, has said signs of the breach were uncovered
three weeks ago, but said it delayed making the breach public until it had
gathered enough information to give help to consumers.</P>
<P>Yet, Hannaford's breach might be exempt from the Massachusetts law because of
a technicality. Specifically, the state statute refers to security breaches
involving personal information - defined as a resident's name in combination
with a Social Security number, financial account number, or driver's license
number. But Hannaford said credit and debit card numbers alone were potentially
compromised. In fact, Hannaford said it doesn't store names at all.</P>
<P>Hannaford said the breach affected more than 270 stores, including those in
Massachusetts, Maine, New Hampshire, New York, and Vermont.</P>
<P>The company is aware of at least 1,800 cases where cards were used
fraudulently. The data breach, among the biggest since hackers stole as many as
100 million credit and debit card numbers from TJX in a case disclosed last
year, lasted from December until March.</P></DIV></BODY></HTML>