Rutter’s convenience store chain settles cybersecurity breach case with $1M in restitution

Attorney General Michelle Henry has announced a settlement with the York-based convenience store chain Rutter’s in relation to a cybersecurity attack that compromised the personal information of over a million customer payment cards.

The cyberattacks occurred over nine months spanning 2018 and 2019, impacting 79 store locations and more than 1.3 million payment cards. Importantly, the breached payment card data was accessed electronically and not through physical store locations.

Following an investigation conducted by the Office of the Attorney General, it was determined that Rutter’s had failed to implement reasonable data security measures to protect consumers’ sensitive personal information, violating Pennsylvania’s Unfair Trade Practices and Consumer Protection Law.

Rutter’s has consented to pay $1 million in financial restitution as part of the settlement agreement. In addition to the $1 million payment, the settlement requires Rutter’s to undertake a risk assessment, document the findings, undergo an independent settlement compliance assessment, and implement security improvements.

Attorney General Michelle Henry stated, “This massive data breach could have been catastrophic for countless consumers whose personal information was exposed due to flimsy safeguards at the time. This settlement involves significant financial payment and assurance that future risk will be minimized.”

The breach came to light on May 28, 2019, when Rutter’s first detected unauthorized activity on its network. However, the company concluded that customers’ payment card information had not been compromised at that time. It wasn’t until December 2019 that Rutter’s became aware of a pattern of unauthorized charges associated with thirty store locations. Subsequently, Mastercard mandated an investigation into the matter. An independent investigator uncovered that threat actors had successfully accessed information tied to at least 1.3 million payment cards within Rutter’s network.

The number of affected consumers and the extent of fraudulent transactions resulting from the stolen card information remain unknown. Rutter’s, headquartered in York, Pennsylvania, operates 80 store locations.