An Arizona-based supermarket chain says it's been victimized by a cyber attack on the stores' online systems, which provided criminals with access to customer payment information.
Bashas' officials say they recently located and removed a highly-sophisticated piece of malware from its systems.
They say victims have been limited to Lake Havasu City and Pinal County, but all customers are being warned to check their credit card and debit card transactions. Bashas' was not specific as to how long ago customers' information was accessed.
"It's disconcerting, you want to think places like this are safe and you're well taken care of but then you're brought back to the reality, we're all vulnerable in some sort of way," said customer Marlen Adams.
"What we have found is a cracking of the financial system of the Basha family food network, so you are talking AJ's, Food City and Bashas' supermarkets, as many as 136 stores possible," said Pinal County Sheriff Paul Babeu.
Babeu says 400 credit card fraud cases involving Bashas' have been reported in Pinal County, and 300 in Lake Havasu City.
Verna Dougall says she was one of the victims.
"January 20 I checked my account and saw a fraud charge made in Illinois," said Dougall. "We are scared to use our credit cards here, now we are using cash."
"Charges that were made in AZ, Texas, as far away as Italy and France. This is an international network operating here," said Babeu. "What this will likely erupt to is thousands and thousands of people across the state that will have been victimized."
Forensic specialists and federal law enforcement officials have begun an investigation into the cyber attack to find those responsible -- and Bashas' officials say they've installed additional security measures to protect customers' personal information from attacks in the future.
Meanwhile, the Pinal County Sheriff's Office needs help identifying three people considered "investigative leads" in the cyber attack. Anyone with information is asked to call authorities.
The company operates Bashas' supermarkets, AJ's Fine Foods and Food City.
Bashas' is and has been compliant with all Payment Card Industry (PCI) security requirements. However, we recently located and removed a highly-sophisticated piece of malware that has never been seen before in the industry. The malware has been identified and contained, and we are working with forensic specialists and federal law enforcement officials in their investigation to find those responsible.
We've also installed additional security measures (beyond what is required by the industry) to our point of sale and enterprise systems to further protect our customers' information from such attacks in the future.
We have fielded some calls about this issue from customers in limited geographic locations. However, we are strongly encouraging all of our customers to closely monitor their debit and credit card transactions and to report any unusual activity.
Statement by Pinal County Sheriff Paul Babeu
All Pinal County citizens who have reported the frauds have had their bank accounts reimbursed. Numerous investigators from various law enforcement agencies are working around the clock to find those responsible and put them behind bars. We need your help to identify the three individuals in the photo provided as they are considered investigative leads. We strongly encourage everyone to closely monitor their debit and credit card accounts and report anything suspicious.
Bashas' customer service: 480-883-6131
Pinal County Sheriff's Office non-emergency number: 1-800-420-8689 or 520-866-5111
The Associated Press contributed to this report.