Breach Report: Albertsons data breach affects 32,000+ workers

Updated 5/3/2023: included Jewel-Osco in the breach

One-sentence summary:

Albertson’s December 2022 data breach potentially affects 32,000+ workers and their sensitive data.

Who was involved?

Albertsons, potentially 32,878 Albertsons employees, Jewel-Osco, and a threat actor.

What was the timeline?

December 22, 2022: Attacker makes initial access into Albertsons

December 23, 2022: Albertsons discovers an intruder in their network

December 24, 2022: Breach ends at Albertsons

March 24, 2023: Albertsons discovers the breach implicates employees’ data

April 21, 2023: Albertsons begins victim notification

What occurred?

In December 2022, an attacker breached Albertsons’s information systems and potentially exposed the sensitive data of over 32,878 employees, including: “names, dates of birth, and Social Security numbers” (Day, 2023; Peretti, 2023). Jewel-Osco is a subsidiary of Albertsons and has also been affected by the data breach (Jewett, 2023).

Estimated costs:

Associated incident response costs, breach notification costs, “leading global forensics firm,”

Involved laws:

State: Maine: 10 M.R.S.A. § 1346

Vermont: 9 V.S.A. § 2435

Root cause:

TBA or N/A (see disclaimer)

Lessons learned:

TBA or N/A (see disclaimer)

Sources:

Albertsons. (2023). Notice of Data Breach. In Data Breach Notifications. Office of the Maine Attorney General. Retrieved April 29, 2023, from https://apps.web.maine.gov/online/aeviewer/ME/40/d02ef7f9-6944-49f7-90c4-b58e96b6edae/c48c498e-b0d7-48b0-8fee-8ebfb69830aa/document.html

Albertsons (freebiesupply.com). (n.d.). albertsons-1-logo.png. freebiesupply.com. https://cdn.freebiesupply.com/logos/thumbs/2x/albertsons-1-logo.png

Day, D. (2023, April 27). Albertsons data breach: employee info stolen. BoiseDev. Retrieved April 29, 2023, from https://boisedev.com/news/2023/04/27/albertsons-data-breach/

Jewett, A. (2023, May 2). Jewel-Osco data breach potentially affects thousands of employees – Top Class Actions. Top Class Actions. https://topclassactions.com/lawsuit-settlements/privacy/data-breach/jewel-osco-data-breach-potentially-affects-thousands-of-employees/

Peretti, K. (2023). Data Breach Notifications. In Privacy, Identity Theft and Data Security Breaches. Office of the Maine Attorney General. Retrieved April 29, 2023, from https://apps.web.maine.gov/online/aeviewer/ME/40/d02ef7f9-6944-49f7-90c4-b58e96b6edae.shtml

About Post Author

Kyler Kent CISSP

Kyler Kent is a Senior Cybersecurity Analyst on CrowdStrike’s Falcon Complete MDR team, where he helps large enterprises detect, investigate, and contain real intrusions across cloud and hybrid environments. His work spans threat hunting, incident response, and security automation—turning noisy telemetry into clear, repeatable actions that reduce risk quickly. Previously, Kyler served as a Threat Hunting and Intelligence Specialist supporting a critical infrastructure provider in Dallas, and led security automation and operational coordination at CyberConvoy. He holds a Master’s in Cybersecurity Risk Management from Georgetown University and maintains certifications including CISSP, AWS Solutions Architect – Professional, AWS Security – Specialty, and multiple CrowdStrike credentials. He writes to close the gap between “what the textbook says” and what analysts actually do on shift with his published book: "SOC Analyst Career Guide" (ISBN-13: 9781835467466). https://linktr.ee/kentprotect.com Corrections: [email protected]

http://kylerkent.com