Natural Provisions, Inc. Data Breach (2013)

Natural Provisions, Inc., a Vermont health foods grocery chain, agreed to pay $30,000 to settle claims brought by the Vermont attorney general that it failed to notify consumers and the attorney general within the statutory period required by Vermont's Security Breach Notice Act and Consumer Protection Act. Natural Provisions, Inc. agreed to pay $15,000 in civil penalties, an additional $15,000 in upgrades for its information technology systems, and to take the steps necessary to prevent future data breaches. The settlement resulted from a security data breach due to credit card fraud at one of its stores. The store learned of the fraud after local police responded to reports from customers that credit card numbers were being stolen and used, tracing it to the Natural Provisions grocery. The store processed about 5,500 transactions a month. Prior to notification, tens of thousands of dollars of credit card fraud took place and some customers had their credit card information stolen a second time after, being unaware that the store was the site of the fraud, they used their replacement cards to make new purchases at the store. Natural Provisions, a company specializing in the sale of organic and natural foods, said it was unaware of the regulations required by the Vermont Security Breach Notice Act because it did not have an IT person on staff and had relied on a consulting group to ensure their security.