Rutter's to pay $1 million in settlement after major data breach

HARRISBURG — Attorney General Michelle Henry has revealed a settlement with the Pennsylvania-based convenience store chain, Rutter’s, following a series of cybersecurity attacks that compromised data from over a million customer payment cards.

The data breach occurred between 2018 and 2019, targeting 79 Rutter’s store locations and affecting over 1.3 million payment cards. The infiltration was carried out electronically and didn’t involve any physical store breaches.

The investigation by the Office of Attorney General concluded that Rutter’s neglected to implement adequate data security measures, thereby putting consumers’ confidential information at risk, violating Pennsylvania’s Unfair Trade Practices and Consumer Protection Law.

Under the settlement terms, Rutter’s has agreed to a $1 million payout and has pledged to enhance its security protocols, which will be assessed by an independent party.

Attorney General Henry remarked, “This significant breach could have had devastating repercussions for numerous consumers whose private data was made vulnerable due to inadequate protective measures. This settlement not only mandates a substantial financial penalty but also ensures a reduction in future risk.”

Rutter’s, which has its headquarters in York and runs 80 stores across Pennsylvania, initially detected suspicious network activity on May 28, 2019. Initially, the company believed that customer payment card details were safe. However, by December 2019, patterns of unauthorized charges linked to 30 Rutter’s stores were identified. Subsequent investigations, compelled by Mastercard, revealed that cybercriminals had successfully extracted details from approximately 1.3 million payment cards within Rutter’s system.

The precise number of consumers affected remains uncertain, as does the tally of fraudulent transactions resulting from the data breach.

As part of the agreement, Rutter’s will be obligated to:

Conduct a risk assessment and undergo an independent compliance assessment.
Maintain a thorough information security program.
Implement efficient password management procedures.
Enforce logging and log monitoring policies.
Regularly update and support its network software.
Deactivate service accounts no longer needed for business functions.
Promptly detect and address suspicious network activities.

The investigation’s leadership was credited to Senior Deputy Attorney General Tim Murphy and Senior Deputy Attorney General Debra Warring.

Phil Stilton Latest posts

Phil Stilton is the Editor and Publisher of Shore News Network, an independent digital newsroom providing original reporting on New Jersey, national news, government, public policy, public safety, courts, and community affairs.

As founder of the publication, Stilton leads editorial strategy, investigative reporting, and daily newsroom operations while overseeing coverage that reaches millions of readers annually.

With extensive experience covering municipal government, county government, state legislatures, elections, law enforcement, emergency management, and public records, Stilton specializes in translating complex government actions into clear, factual reporting. His work frequently relies on primary source documents, including court filings, legislation, public meeting records, election finance disclosures, government databases, police reports, and Freedom of Information and Open Public Records Act (OPRA) requests. He has reported extensively on local government accountability, taxpayer spending, campaign finance, public corruption investigations, infrastructure, public safety, and the policies affecting New Jersey residents.

Under Stilton's editorial leadership, Shore News Network has grown into one of New Jersey's largest independent digital news organizations, publishing thousands of original news articles each year while providing breaking news coverage, investigative reporting, and analysis across state and local government. The publication's reporting is routinely sourced from official government agencies, public officials, court records, and firsthand documentation, with a commitment to transparency, attribution, corrections when warranted, and clearly distinguishing factual reporting from opinion.

Stilton's journalism follows established newsroom standards emphasizing accuracy, verification, fairness, and accountability. Every effort is made to verify information through official records and multiple reliable sources before publication. His reporting is intended to provide readers with timely, well-documented information that helps them understand the issues affecting their communities, while maintaining editorial independence from political parties, government agencies, advocacy organizations, and commercial interests.

Readers can submit story tips, corrections, public records, or media inquiries through the official Shore News Network website or its verified social media channels. Shore News Network welcomes corrections and updates when new information becomes available as part of its ongoing commitment to accurate and transparent journalism.