1. [News](/news) 2. Kroger latest victim of Accellion breach Kroger # Kroger latest victim of Accellion breach Kroger is the latest addition to a growing list of victims impacted by the cyber attack against the file transfer solution, Accellion. Edward Kost February 21, 2021 Kroger is the latest addition to a growing list of victims impacted by the cyber attack against the file transfer solution, Accellion. Kroger is a Cincinnati-based grocery and pharmacy retailer with 2,750 grocery retail stores and 2,200 pharmacies across the United State. [Kroger announced](https://www.prnewswire.com/news-releases/accellion-security-incident-impacts-kroger-family-of-companies-associates-and-limited-number-of-customers-301231891.html) that less than 1% of its customers were impacted by the breach. “At this time, based on the information provided by Accellion and its own investigation, Kroger believes that less than 1% of its customers, specifically customers of Kroger Health and Money Services, have been impacted,” Kroger said in its breach statement. The compromised data did not include financial and login details. > “No credit or debit card information or customer account passwords were affected by this incident.” After being notified of the incident on January 23 by Accellion, Kroger terminates its vendor relationship with them. ### How did the Accellion breach happen? The culprit behind this tumultuous global debacle is a legacy file-sharing app that should have been decommissioned years ago. Accellion developed a solution to overcome the slender file size limitations of email attachments. The File Transfer Appliance (FTA) was created, allowing recipients to download large files via a link in an email instead of attaching them. This technology was revolutionary for its time. Law, finance, and even government sectors embraced the solution saving them from email attachment frustrations. But that was 20 years. Even though file sharing has significantly evolved into secure cloud solutions, prestigious organizations are still using the legacy Accellion product to this day. With such an irresistible network protected by perforated defenses, it was a matter of time before a hacker tore through Accellion’s security and claimed their prize. There were several vulnerabilities exposing FTA, these included: * An FTA interface SQL injection flaw * An XSS flaw in FTA’s file manager * A blind SQL injection flaw in FTA’s admin interface * A command injection flaw in FTA’s admin interface These vulnerabilities remain unpatched, and despite Accellion’s prompts, legacy customers didn’t transition to the company’s updated file sharing solutions. In mid-December 2020, an attacker finally breached Accellion, accessing the private data of the many customers still using their legacy product at the time. Some of the victims impacted by this attack include: * [Washington State](https://sao.wa.gov/breach2021/) * The Australian Securities and Investments Commission (ASIC) * [Reserve Bank of New Zealand](https://www.upguard.com/news/new-zealand-central-bank-cyberattack) * [Singtel](https://www.upguard.com/news/singtel-cyberattack) This list keeps growing with victims surfacing almost every week. Accellion has financially decided to [retire its legacy FTA software](https://www.accellion.com/sites/default/files/resources/fta-eol.pdf) on April 30, 2021. This incident, which will likely continue to unfold deep into 2021, uncovers two concerning trends - the liberal adoption of insecure legacy solutions and poor vendor security practices. To sever these dangerous trends, organizations need to evaluate the security of their [internal solutions](https://www.upguard.com/product/breach-risk) and scrutinize the [defense efforts of their vendors](https://www.upguard.com/product/vendorrisk). ## How secure is Kroger? Kroger operates a chain of supermarkets and retail stores across the United States. The company sells groceries, household goods, pharmacy products, and fuel through multiple store brands and formats, including traditional supermarkets and marketplace locations. * View our free preliminary report on Kroger's security posture * 13 risk factors, including email security, SSL, DNS health, open ports and common vulnerabilities [View Kroger's score View score](/security-report/kroger) [https://kroger.com/](/security-report/kroger) ## Latest news Stay up-to-date with the latest news in cybersecurity. * ### [Hugging Face data breach: key facts and what we know so far](/news/hugging-face-data-breach-2026-07-20) A data breach involving Hugging Face was reported in July 2026. See incident details, impact on customers, and recommended security measures. UpGuard Team July 20, 2026 * ### [EY data breach: what happened and what's at risk](/news/ey-data-breach-2026-07-19) A data breach involving EY was reported in July 2026. See incident details, impact on customers, and recommended security measures. UpGuard Team July 17, 2026 * ### [South Florida Injury & Convenient Care data breach exposes names and Social Security numbers](/news/south-florida-injury-convenient-care-data-breach-2026-07-16) A data breach involving South Florida Injury & Convenient Care was reported in July 2026. See incident details, impact on customers, and security measures. UpGuard Team July 16, 2026 * ### [Park West Psychology data breach: what happened and what's at risk](/news/park-west-psychology-data-breach-2026-07-16) A data breach involving Park West Psychology was reported in July 2026. See incident details, impact on customers, and recommended security measures. UpGuard Team July 16, 2026 * ### [Fall River Municipal Credit Union data breach: what happened and what's at risk](/news/fall-river-municipal-credit-union-data-breach-2026-07-16) A data breach involving Fall River Municipal Credit Union was reported in July 2026. See incident details, impact on customers, and recommended security measures. UpGuard Team July 16, 2026 * ### [NPCIL data breach: World Leaks claims exposure of Kudankulam Nuclear Power Plant files](/news/npcil-data-breach-2026-07-16) A data breach involving NPCIL was reported in July 2026. See incident details, impact on customers, and recommended security measures. UpGuard Team July 16, 2026 [View all news](/news) ## Sign up for our newsletter UpGuard's monthly newsletter cuts through the noise and brings you what matters most: our breaking research, in-depth analysis of emerging threats, and actionable strategic insights.