Evan Schuman's StorefrontBacktalk

It is IT’s worst nightmare: What if an armed violent criminal hits the store and empties the safe and, perhaps unintentionally, takes our unencrypted data backup? It happened to Kmart at its store in Little Rock, Ark., according to a statement parent company Sears (NASDAQ:SHLD) issued Monday (April 22).

The statement, which came more than a month after the March 17 armed robbery, was forced by rules from the Health Insurance Portability and Accountability Act (HIPAA). When a breach impacts more than 500 state residents—Kmart is quoted by The Chicago Tribune saying that 788 Kmart shoppers were impacted—the retailer has 60 days to announce it.

Asked why the delay, Sears spokesperson Shannelle Armstrong-Fowler pointed out that the chain moved much more quickly than the law requires. “Under HIPAA guidelines, 60 days are available for a health care entity to investigate and report on a potential breach. We completed our investigation and notified customers in approximately thirty days,” she said.

Arkansas state law also requires disclosure, but it’s much more ambiguous about timing: “The disclosure shall be made in the most expedient time and manner possible and without unreasonable delay, subject to any measures necessary to determine the scope of the breach and to restore the reasonable integrity of the data system.”

At 8:55 p.m., some 55 minutes after the store had closed, the intruder confronted the store’s assistant manager, who had just closed the store for the night, when he went into the parking lot to get to his car. The thief stabbed the assistant manager’s car’s front driver side tire, presumably so that the assistant manager would be occupied when the thief pointed a silver gun at him and ordered him to open the store and to then open the safe, according to the police report. The thief helped himself to the contents, including about $6,000 in cash and that day’s backup disk.

The disk, which was unencrypted and apparently not password-protected, included the full names, addresses, dates of birth, prescription numbers, prescribers, insurance cardholder IDs and drug names for some 788 customers, according to Sears. “Certain prescriptions also contained the customer’s social security number,” said the Sears statement.

Sears’ Armstrong-Fowler said that “a few hundred customer SSNs were potentially involved and those customers have been individually notified.” She added that no payment card data was involved.