More than two dozen supermarkets and grocery stores in western Montana are among 160 across the Pacific Northwest whose electronic payment system has allegedly been hacked by thieves.
Some of their customers are discovering unauthorized charges on their cards – from a Lake County man who found $75 in gasoline purchased on a card with his number on it in Texas, to a Spokane couple who were surprised to find they had paid for $18 worth of food at a Kentucky Fried Chicken in New Dehli, India.
The common theme seems to be grocery stores that use URM Stores, a Spokane wholesaler, to process electronic payments. URM Stores, in turn, uses First Data Corp. of Atlanta to process its payment transactions.
A Secret Service investigation is underway.
URM Stores CEO Ray Sprinkle told the Missoulian the Montana stores apparently affected include Rosauers, Super 1 Foods, Harvest Foods and Family Foods.
The company serves approximately 160 member stores in Washington, Oregon, Idaho and Montana that collectively own it. URM Stores is also their primary food distributor.
URM Stores says it has been advised by law enforcement it “may have been the target of a criminal cyber attack against our payment processing system.” It also has recommended customers pay by cash or check, or for stores to use slower dial-up connections that are not affected, until the problem is isolated and dealt with.
“We’re working diligently to secure our system,” Sprinkle told the Missoulian on Tuesday afternoon. On Monday, the company provided a toll-free number – 1-877-237-7408 – for customers who have questions about what has happened and want to know what steps they can take to protect themselves.
Many stores were moving to address the problem while awaiting a solution.
At Rosauers, which has stores in Missoula, Kalispell, Libby and Bozeman, CEO Jeff Philipps said steps were instituted Monday morning to protect its customers.
The stores are also deducting 10 percent off purchases, be it for a pack of gum or a basket full of groceries, while the steps are in place.
“We discontinued the use of the network to process any kind of payment after we were informed over the weekend,” Philipps said, “and we’re only using a separate and secure land line for card transactions. It takes a little bit longer, but we don’t want to jeopardize our customers’ information.”
The 10 percent discount applies to virtually everything except prescription drugs and money orders, Philipps said.
The breach in security is also affecting dozens, if not hundreds, of banks and credit unions across the region.
“We’ve been dealing with it for a couple of weeks,” said Lisa Skalsky, chief financial officer at Eagle Bank in Polson. “We did suffer some losses, but we were able to mitigate some of that.”
The fraud was all based on signatures, and not personal identification numbers, Skalsky said, which meant counterfeit cards were being presented to merchants.
Many of the unauthorized transactions were occurring in convenience stores, liquor stores, smoke shops and big-box retailers in other states, she added. By blocking transactions in certain states and with certain merchants or types of merchants for a period, banks and credit unions can stem the fraud.
“They’ll use those cards until they can’t,” Skalsky said of people who steal, or purchase from cyber thieves, the card information.
In addition to the Rosauers locations, Sprinkle said stores affected include:
• Super 1 Foods in Columbia Falls, Evergreen, Hamilton, Kalispell, Polson, Stevensville and Whitefish.
• Harvest Foods in Bigfork, Darby, Lolo, Ronan, St. Ignatius and Thompson Falls.
• Family Foods in Browning, Eureka, Hamilton, Lakeside, Pablo, Plains, Ronan, Superior and Troy. Family Foods outlets are often better known by other names: Stein’s Market in Eureka and Troy, Marketplace in Hamilton, Blacktail Grocery in Lakeside, McGowan Grocery in Plains, Mission Mart in Ronan and Castles Market in Superior.
The 25 Montana stores are just the tip of the iceberg. URM Stores members include 61 more Harvest Foods or Family Foods locations in Washington, Idaho and Oregon, 10 more Rosauers, 10 more Super 1 Foods, a dozen Yoke’s Fresh Markets, seven Center Place Markets, four Trading Company Stores, plus several more grocery stores unaffiliated with any of those.
Skalsky encouraged debit and credit card users to check their accounts online often to watch for unauthorized purchases.
URM Stores said if anyone suspects their card has been compromised, they should contact the bank that issued the card immediately. Major credit card companies, it noted, have “zero liability” policies that guarantee cardholders will not be responsible for fraudulent charges.
“We believe that the attack is targeting data found in the magnetic strip on the back of credit and debit cards,” the company said in a news release. “This information is typically used to make counterfeit cards.”
“We are working around the clock implementing enhanced security measures to block any further unauthorized access to our system,” URM Stores said.