The companies said that in late August or early September, malicious Albertsons said the malware may have captured data including account numbers, card expiration dates and the names of cardholders at stores in more than a dozen states. Supervalu said the malware was installed on a network that processes card transactions at several chains, but it believes data was only taken from certain checkout lanes at four Cub Foods stores in Minnesota.