Regional Grocery & Restaurants · Grocery · Regulatory action + Data breach
Wegmans
Headline
Wegmans was penalised by the New York Attorney General over a breach in 2022, and the cause is the kind that is hardest to defend: misconfigured cloud storage left customer data publicly accessible.
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
Wegmans was penalised by the New York Attorney General over a breach in 2022, and the cause is the kind that is hardest to defend: misconfigured cloud storage left customer data publicly accessible. No attacker skill was required - the container was simply left open, which is an unforced error rather than an adversary overcoming a defence. Grocery loyalty data is also more revealing than people assume, since purchase history supports inferences about pregnancy, chronic illness, addiction, religious observance and household composition without any of it being declared.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Primary source. None recorded — Unverified - heuristic first draft.
Terms
Arbitration
Not independently confirmed this pass — standard binding arbitration + class action waiver expected.
Data sharing
CONFIRMED, REGULATOR-PENALIZED BREACH (NY AG settlement, June 30, 2022): Wegmans left TWO cloud storage databases MISCONFIGURED AND PUBLICLY ACCESSIBLE for YEARS — one had been openly accessible since it was set up in November 2018, undetected until 2021 — exposing personal information of more than 3 MILLION consumers nationwide (830,000+ in New York alone), including usernames/passwords, names, emails, mailing addresses, and data DERIVED FROM driver's license numbers. NY AG Letitia James found Wegmans had failed to even INVENTORY its own cloud assets containing personal data, and had kept driver's-license-derived checksums 'without a reasonable business purpose.' Wegmans paid $400,000 in NY penalties and must now maintain a comprehensive security program, annual penetration testing, and 90-day-minimum activity logging. SEPARATELY, a 2021 credential-stuffing incident affecting roughly 2,700 Wegmans.com accounts has been reported (not mentioned in the NY AG release; not independently verified this pass).
Fees and billing
Not itemized this pass.
Contacts
Privacy contact. Not recorded.
Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
No sources are on file for this row yet.
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy wegmans.com/privacy-policy | Not fetched yet | NO (HTML only) |
| Terms of service wegmans.com/terms-of-use | Not fetched yet | NO (HTML only) |
| Website No URL recorded | Not fetched yet | — |
| Primary source No URL recorded Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
No HQ state on file, so no state statute applies by headquarters.