Wegmans Biometric Data: Face Scans After 3M-Customer Leak

A man named Harvey Murphy Jr. was arrested for a robbery in Houston, Texas. At the time of that robbery, he was in Sacramento, California. That's thousands of miles away. A facial recognition system had matched his face to a blurry store camera image.

If you've ever walked into a store, you've been on

If you've ever walked into a store, you've been on camera. That's true for all of us. And it's a little unsettling to realize a computer's guess about a face can outweigh where you actually were.

If that scares you, it's a reasonable reaction. But understanding how these mistakes happen is how you stop feeling powerless. Today we'll look at why a "high confidence" match can still be wrong. We'll look at who those errors land on. And we'll look at why a grocery chain's data breach belongs in this story. So how does a machine get it that wrong?

Start with what the system actually does. It doesn't recognize anyone. It turns a face into numbers, then looks for other faces with similar numbers. The result is a similarity score. It's a probability, not an identity.

Now, the camera matters enormously. According to the reporting on Murphy's case, the image came from low-quality cameras. Poor lighting, a tilted angle, or low resolution all strip away detail. Less detail means more people look alike to the machine.

Here's what the score doesn't know

And here's what the score doesn't know. It doesn't know the footage was grainy. It doesn't know the match put someone in Houston who was in Sacramento. It only knows two sets of numbers look close.

Why do people trust the number anyway? Because companies advertise accuracy figures like ninety-five percent. That sounds nearly perfect. It's natural to hear that and assume errors are rare.

Picture a stadium with a hundred thousand people. You're searching for one person. A system that's ninety-five percent reliable could still flag about five thousand wrong people. The system will always find people who look similar. A higher score makes the match feel more certain. It doesn't make it more certain.

For investigators, that means a match is a starting point, not proof. For the rest of us, it means a computer's "match" shouldn't outrank a real alibi.

The next misconception is that these errors hit

The next misconception is that these errors hit everyone equally. It's an easy assumption. If it's a glitch, you'd expect it to be random.

But according to the Federal Trade Commission, Rite Aid used facial recognition to catch shoplifters. The system produced thousands of false matches. It misidentified women and people of color more often. The F.T.C. also found the technology was concentrated in stores in more diverse city neighborhoods. That's even though about eighty percent of Rite Aid stores sit in areas that are mostly white.

Part of the reason is training data. These systems learned from image sets that skewed toward lighter skin. Rite Aid also didn't test for that kind of bias before rolling it out. So the error wasn't random. It was predictable.

In Detroit, at least three people were falsely accused because of this technology. All three were Black. Some were arrested in front of their families. That number stopped me cold.

The arrest isn't always the worst part

And the arrest isn't always the worst part. In false alerts at stores, employees followed people around, searched them, and told them to leave. Some called the police. In Murphy's case, according to his lawsuit, there was also an assault while he was in jail.

Now, where does Wegmans fit in? According to the New York Attorney General, a Wegmans cloud storage container was misconfigured from January 2018 until April 2021. That exposed data on more than three million customers. It included names, emails, addresses, passwords, and driver's license numbers. Wegmans later paid four hundred thousand dollars to settle.

Separately, Wegmans posted signs at some New York City stores. They warned that face, eye, and voice data could be collected. Most shoppers walk right past them.

Here's why that matters. You can change a stolen password. You can cancel a credit card. You can't change your face.