Wegmans Must Pay New York $400,000 After Cloud Security Lapse

Wegmans Food Markets Inc. has agreed to pay New York state $400,000 for leaving customers’ personal data exposed on the cloud in misconfigured cloud storage containers.

The deal, announced Thursday by New York Attorney General Letitia James (D), comes after the state’s investigation of the Rochester, N.Y.-based supermarket chain storing the personal information of 3 million consumers in misconfigured containers. More than 830,000 New Yorkers’ information was exposed in the security lapse, James’ probe found.

Wegmans has agreed to maintain a comprehensive information security program, establish policies to protect cloud assets, and develop a penetration testing scheme. The deal’s ...