Store chain to pay $1M to settle Pa. AG breach suit

A convenience store chain will pay $1 million to settle a lawsuit filed by the Pennsylvania attorney general in connection with cybersecurity attacks that exposed information from 1.4 million payment cards over a nine-month period in 2018 and 2019.

Pennsylvania Attorney General Michelle A. Henry charged that York, Pennsylvania-based CHR Corp., a privately held company that conducts business as Rutter’s, did not use appropriate information security practices in 79 store locations, according to court papers filed in state court Wednesday in Commonwealth of Pennsylvania By Attorney General Michelle A. Henry v. CHR Corp. d/b/a/ Rutter’s.

Under terms of the settlement, in addition to paying the $1 million, Rutter’s must develop and maintain a comprehensive information security program, conduct comprehensive risk assessments and obtain a third-party information security compliance assessment and report within one year.

Ms. Henry said in a statement, “The settlement involves significant financial payment, but future risk will be minimized.”

The company’s attorneys did not respond to a request for comment.