Caribou Coffee notifies customers of data breach

Minneapolis-based Caribou Coffee disclosed Thursday that customers' credit card numbers and other security information may have been accessed as part of a data breach it first noticed on Nov. 30.

The company, which purchased Bruegger's Bagels in 2017 and has a shared ownership with Einstein Bros. Bagels, declined to say how many customers were affected.

In a notice posted on its website and sent to media organizations, Caribou Coffee listed 265 company-owned stores that were tied into the point-of-sale system that was attacked.

Most of the stores are in Minnesota, but the notice includes coffee shops in 10 other states, including Iowa.

The retailer's Coralville store, among other Iowa locations, was included on a list of affected locations, but not its venues in Cedar Rapids or Iowa City.

Caribou said that customers who made a purchase with a credit or debit card between Aug. 28 and Dec. 3 may have had their name, credit card number, expiration date and security code stolen.

A letter from Caribou Coffee President John Butcher said the company reported the security breach to the FBI.

The company also is working with a leading cybersecurity firm to understand the scope of the incident, which explained the lag between when the breach was first discovered and when Caribou made an attempt to notify customers.

Caribou Coffee was purchased for $340 million by a privately held conglomerate, the Luxembourg-based JAB, in 2012.