Paul Stephens, of the San Diego-based consumer advocacy organization Privacy Rights Clearinghouse, said the delay in disclosure "puts consumers in a difficult position because they have no way of knowing whether their accounts may have been impacted."
Eleazer defended Hannaford's actions.
"We moved with all deliberate speed to get out to customers with information that we could have confidence in," she said. "This is a complex undertaking."
The case ranks among the largest breaches on record involving retailers, but far fewer cards were exposed than in the largest hack. That one began in 2005 - and was disclosed last year - at TJX Cos., the Framingham, Mass.-based operator of more than 2,500 discount retail stores including T.J. Maxx and Marshalls.
TJX reported at least 45.7 million cards were exposed, while banks' court filings put the number at more than 100 million, but there has been no estimate of the total fraud.
Associated Press Business Writer Mark Jewell in Boston contributed to this report.