2021 Kroger — Accellion FTA compromise; HR, pharmacy & money-services files; <1% of customers per company statement

Kroger disclosed that January 23, 2021 notification from Accellion meant criminals had abused legacy FTA zero-days against a perimeter file-transfer workflow segregated from core grocery POS. The grocer’s consumer notice and SecurityWeek’s recap both emphasize categories like associate HR, Kroger Health pharmacy, and money-services documentation—while stressing no broad payment-card or grocery-account-password theft from Kroger-controlled stores. Kroger publicly said fewer than 1% of customers were in-scope for letters, deferring a precise population table.