The bank said it first learned of the vulnerability on Jan. 22, while a ransomware gang doxed employees in an extortion attempt.

Kroger is only the latest firm to be swept up in a breach that began at Accellion, a software provider.