Yoke’s, Rosauers urge customers to not use cards amid network hack

Some Spokane-area grocery stores, including all 12 Yoke’s Fresh Markets and 21 Rosauers stores, are telling customers that debit and credit card payments won’t be processed normally while investigators try to secure a computer network that was hacked over the past two months.

The data breach was reported in recent weeks by local banks and credit unions.

Customers entering Yoke’s and Rosauers stores on Monday were told they can use a secure but much slower dial-up connection to make card payments. The other options are to pay by check or with cash.

“This is a ridiculously horrible time for this to happen,” Yoke’s CEO John Bole said Monday morning. As families stock up on groceries and beverages for Thanksgiving, the timing almost couldn’t be worse for area grocers, he said. For most grocery stores, the Thanksgiving week is one of the busiest of the year.

The 21 stores in the Rosauers group, which includes Super 1 Foods and Huckleberry’s Natural Market, offered 10 percent discounts to shoppers on Monday, whether they used a card or not.

“We feel it’s fair because we didn’t tell people ahead of time they’d have to go through this,” Rosauers CEO Jeff Philipps said.

Monday’s actions by the grocery chains followed a recommendation by URM Stores, the Spokane-based wholesaler that processes a large share of electronic payments made by shoppers at Yoke’s, Rosauers, Super 1 Foods, Family Foods, Harvest Foods, CenterPlace Market and Trading Co. Stores.

On Monday, URM Stores CEO Ray Sprinkle posted a notice on the company’s website urging most of the stores it works with to stop normal credit card transactions until the problem is solved.

Sprinkle said the data breach occurred at URM, not at individual stores nor at Atlanta-based First Data Corp., which processes payment transactions for URM.

URM Stores is a member-owned cooperative that has been in business since the 1920s. It also serves as the primary food distributor for the member grocery stores that collectively own it.

Sprinkle added that the computer network that appears compromised is used by roughly 160 grocery stores in Eastern Washington, Idaho, Western Montana and Oregon.

“We are doing this so that we can provide protection for those consumers who use our member stores,” Sprinkle said.

While most of its network stores are now using only the slower, dial-up link, some stores don’t have to change how they process card transactions because they don’t use the URM network for card data, Sprinkle noted.

Sprinkle said the extent of the fraud is uncertain, but bank and credit union officials say no similar fraud spree is occurring anywhere else in the country.

He said forensic experts also haven’t pinned down when the hack took place or the method used.

“I’m not going to speculate on those questions,” Sprinkle said. “What we see is that our investigators have found signs of an attack.”

Concerns about URM’s network arose in recent weeks, as consumers discovered unauthorized card purchases on their accounts.

The Spokane office of the Secret Service is helping with URM’s investigation.

First Data, the transaction processor, this week also said it is investigating the rash of card fraud occurring in the Northwest.

URM’s announcement Monday warned customers that using cards with the dial-up processing option would take more time at stores where it is available.

To help move customers through longer lines, Yoke’s store managers are waiving ATM fees to help customers get cash for payments, said Jeff Weisgerber, manager of the Foothills Drive location. The ATM machines aren’t part of the URM network.

Spokane resident Donald Frogner said he and his wife had card fraud reports both in Florida and in India.

Frogner, a former Air Force communications engineer, said “We found a payment for $18 for a Kentucky Fried Chicken in New Delhi.”

He added: “This isn’t a bunch of teenagers hacking in and getting cards. This is a sophisticated effort,” in that some of the fraud involves the use of physical cards at cash registers, instead of online fraud.

He and his wife also saw more than $1,200 in unauthorized charges based in Florida.

Spokane Media Federal Credit Union CEO Debie Keesee said her institution is proactively replacing about 350 credit or debit cards in order to protect members.