Slashdot Mirror
Clueless About Card Data Hack, PF Chang's Reverts To Imprinting Devices
wiredmikey writes: After saying earlier this week that it was investigating reports of a data breach related to payment cards used at its locations, P.F. Chang's China Bistro confirmed on Thursday that credit and debit card data has been stolen from some of its restaurants. What's interesting, and somewhat humorous, is that the company said that it has switched over to manual credit card imprinting systems for all of its restaurants located in the continental United States. The popular restaurant chain said that on Tuesday, June 10, the United States Secret Services alerted the company about the incident. Admitting that it does not know the extent or current situation and impact of the attack, the company noted in a statement: "All P.F. Chang's China Bistro branded restaurants in the continental U.S. are using manual credit card imprinting devices to handle our credit and debit card transactions," the company said. "This allows you to use your credit and debit cards safely. If it's not obvious, anyone who has visited a P.F. Chang's and used a payment card in the last several months should monitor their accounts and report any suspected fraudulent activity to their card company.
My credit union prints their own cards... which don't have a relief on the printed data... so they can issue them directly from the branch. If you want relief on your card, you have to order it through the mail. So I guess I'm not eating at Chang's tonight
Which has more power: the hammer, or the anvil?
One of my cards was reissued without raised digits on it about 3 years ago, so this plan might not work out so well for them. Also, I wonder how many of the 19 year-olds working there's minds just got blown by the swipe machine and now know why credit cards (used to) have raised digits.
There are a lot of cards now with don't have the numbers imprinted on them. Am I going to have to manually write out my card information when I go there now because these incompetent people can't be bothered to hire a couple security people and fix the problem instead of making it inconvenient and no more secure for anybody. Also a credit card swipe is pretty much automatically processed, what kind of delay will be on the manual transactions?
I heard the USA will finally get proper Chip & Pin cards next year ?
I visited the US recently and discovered the joy of swipe & signature on paper receipts... It really feels like 3rd world technology.
> So now I can physically steal boxes of credit card numbers with signatures right at the bottom?
Everybody understands physical security. Store the boxes in a locked closet in the managers office and the the number of people who have access is reduced to a handful of employees - all of which are also subject to our local legal system. Put the data on the network and the number of people who might have access to it is practically the entire internet, the majority of which are outside of US jurisdiction.
A company that didn't know it was breached, doesn't know the extent of the breach, and who's answer to the breach is to revert to 40-year old tech using the phrase "If it's not obvious..."
~Knowledge is knowing that a tomato is a fruit, but Wisdom is knowing not to put it in a fruit salad.
5 minutes to look in a filing cabinet? Are you kidding me? Do you know how many people would be in that filing cabinet? Something like 30-60 million, assuming they somehow know when to magically remove the ones who died.
We were all warned a long time ago that MS products sucked, remember the Magic 8 Ball said, "Outlook not so good"
its illegal to use those devices in California. I thought the whole reason those were phased out was because they actually facilitated card theft...
I was under the impression (no pun intended) that the old-school imprint technique was declared unacceptable (in the PCI-DSS rules) a few years back.
Perhaps the rules for securing the imprints were just so cumbersome that it made using them completely impractical. I can't imagine fast food joints maintaining the physical security required for this.
Also, do you know how large that filing cabinet would even be? A cabinet with 18" deep drawers that is 18,182 feet high.
We were all warned a long time ago that MS products sucked, remember the Magic 8 Ball said, "Outlook not so good"
You'll see things here that look odd, even antiquated to modern eyes, like phones with cords, awkward manual valves, computers that, well, barely deserve the name. It was all designed to operate against an enemy who could infiltrate and disrupt even the most basic computer systems. Galactica is a reminder of a time when we were so frightened by our enemies that we literally looked backward for protection...
Show me on the 1st Amendment bobblehead where the moderator touched you...
Unfortunately this makes your Identity EASIER to steal... since filing cabinets' auditing systems are easy to bypass, and it's hard to know if the data has been accessed/stolen. The inside job is far too easy with this scenario.
Which has more power: the hammer, or the anvil?
Back in the 80s I worked for a company that did back office accounting systems. Then I moved to a large non-profit and was in charge of both back office and customer facing systems. This was when the Internet was for non-commercial traffic only, so "customer facing" meant a live operator at a dumb terminal hooked up to a minicomputer.
My new employer wanted me to develop a system that would among other things take credit cards from donors and volunteers. I was pretty confident on the technical end of things, but I wasn't sure about handing the financial data. So I called in a CPA friend I'd met at my prior job, and he looked over a the design documentation for the system to make sure everything was kosher.
"You can't store credit card information in the database," he said.
"Why not?"
"Because it's insecure," he said.
"But it's convenient," I said.
"That's the problem," he said. "Look, any of the operators will be able to look up credit card information on any donor. Some of these donors are rich. You'd be able to go on one hell of a shopping spree with just one of their credit cards."
"What if I make it harder to look up the data?"
"Then it's not convenient anymore," he said. "Look, you don't actually have a use for this data once you've processed the credit card transactions. And while you're keeping it around in case you might someday have a use for it, it leaves you wide open to theft. It'd be a disaster; customers won't do business with you because your reputation will be in the toilet. Get rid of it. Get it out of the database, any logs you have, and make sure it's not in any backup tapes."
And when I thought about it I realized he was right. There was no point in exposing my employer to risk for no real benefit. That's when I learned an important principle of security: don't hold onto sensitive data that you don't actually have a use for. I suppose you could generalize: don't keep sensitive data on any system where there is no compelling need to store it there.
Things have changed now; storing credit card data has come to be regarded as routine in the post-1 click, impulse buy Internet world. But even though it is the *norm*, that doesn't mean you should automatically do it. There's actually a use in a web store for storing credit card data which offsets the risk (which you should still minimize). There's no reason for a restaurant to store credit card information -- that's just blind habit. Waiter takes the customer credit card, runs the transaction, and hands the card back to the customer, and then restaurant no longer has the data. You can't lose what you don't have.
Of course in this case it's probably not P.F. Chang's fault. They bought a POS system which left them open. It probably is all slick and really very helpful at keeping things moving, like maybe taking the customers card at the table. It'd be interesting to know how the POS system vendor screwed this up, because clearly they did.
There is no encryption or security architecture that beats not having the data.
Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.
Credit cards are a ponzi scheme, are not backed by any hard currency, cannot be used to pay taxes and are only used by drug dealers and money launderers. Oh, wait....
Prove anything by multiplying Huge Number times Tiny Number
...the clunk-a-chunk machine.
I know retro is in, but this is going too far.
systemd is Roko's Basilisk.
How the heck does old fashioned imprinting help me to use a debit card?
Do these people actually not understand any of this technology?
Lost at C:>. Found at C.
The slip's form fields align with a credit card, but that doesn't mean the waitstaff can't write it in by hand. Impressions just made it faster, and gave some limited proof of "card presence."
Also, why would you eat at PF Changs? PF Chang's is for people too afraid (to be polite) to step into the local Asian restaurants. It's overpriced low-to-mid-tier produce/meat with a sauce that came out of a can. If you're lucky, that can says "PF Changs teriyaki sauce", not "Sysco teriyaki sauce."
I once ate there and the waiter actually felt it necessary to tell us that "soy sauce is like salt for chinese food."
Stop eating at chain restaurants. They suck - the food's bad, they run the local non-chains out of business - and they prey upon people who want bland consistency. Live a little. Support the local economy. Etc.
Please help metamoderate.
Physically, you can steal one box at a time, perhaps 1000 receipts. And the thief must be physically present, and risk his ass getting caught doing so.
Electronically, you can sit in Odessa, Ukraine, and steal 44 million accounts from every cash register at a major retailer. And the thief risks absolutely nothing, because his government is too busy fighting the Russian separatists who have taken over City Hall.
See the difference?
John
Cash, when stolen, is gone. I'd rather not go back to the days of carrying a a hundred bucks or more in my wallet when going out for the night, walking back to my car in a dimly lit street surrounded by sketchy/drunk people.
Somebody steals my card - or card info - I cancel the card. It's done. I owe no debts so long as I watch my charges and report if something goes wrong
Somebody steals my wallet with my card. I cancel the card. It's done. I owe no debts so long as I report the card stolen
Somebody steal my cash.... the cash is gone, and I'm not getting it back.
If you are such a paranoid douche, then why the fuck are you donating blood? You know the gubbermint is really taking your blood and doing a full DNA analysis on it to find the key genome sequence that will grant Obama immortality, so he can declare himself supreme ruler for the next 300 years and enslave the rest of rest of humanity in FEMA camps as part of the Reptoid conspiracy.
Doesn't the merchant have to send the imprint to the CC company (who presumably shreds them)? Or do you mean the carbon copy that they give you? Because that's the customer's problem. Also, the newer slips don't imprint the full card number on the copy, IIRC.
Check out my sci-fi/humor trilogy at PatriotsBooks.
So all you have to do is get the carbons from the trash now for those, like back in the 80s??
When the physical security is breached, the customers at that one store with the rogue employee/thief is affected. When the records are online, you can have all the customers at many/all the stores are affected by a single breach.
Again, chip-an-pin would be less work that rolling out imprinting devices, and would be much more secure.
Except not by PFChangs. The whole point is to be able to get money from customers, but, PF Changs's US customers don't have a CC with chip&pin. It has to come from the credit card companies.