P2011-ND-011

The Organization uses a US-based, third-party marketing organization, Epsilon, to send email notifications and to manage the Organization’s loyalty program. On March 31, 2011, the Organization was notified by Epsilon that it had experienced a massive data breach and that the Organization’s customers were among the affected individuals. Specifically, on March 30, 2011, Epsilon investigated an alert regarding unusual download activity and discovered that login and password credentials for an email application administrator had been compromised and client information had been downloaded to an FTP site in another country on March 29, 2011.