Slashdot Mirror
Wendy's Says More Than 1,000 Restaurants Affected By Hack (go.com)
An anonymous reader writes from a report via ABC News: The fast food giant Wendy's has reported today that hackers were able to steal customers' credit and debit card information at 1,025 of its U.S. restaurants. The company said Thursday hackers were able to obtain card numbers, names, expiration dates and codes on the card, beginning in late fall. Some customers' cards were used to make fraudulent purchases at other stores. Wendy's first announced it was investigating a possible hack in January. In May, it found malware in fewer than 300 restaurants; two types of malware were found two months later and the number of restaurants affected was "considerably higher." There are more than 5,700 Wendy's restaurants in the U.S. Customers can check to see which locations were affected via Wendy's website. The company said it is offering free one-year credit monitoring to people who paid with a card at any of those restaurants. In May, Wendy's announced plans to start automating all of its restaurants with self-service ordering kiosks.
Just f*cking great. Just what we needed. Another breach.
There's a fly on my soup!
WaReZ da B33F!!
Now, if you'll excuse me, I have backups to corrupt.
pay with cash.
Though I do use my CC sometimes as well.
We play the game with the bravery of being out of range
Considering some of the world's top financial services corporations are working on ways to incorporate Blockchain for many types of transactions, perhaps it's time for the retail world to jump onboard too. It could allow consumers and retailers to connect directly and form online networks, removing the need for middlemen and do it securely.
It's time to go back to paying with cash for these kinds of purchases.
Cars, boats, homes, and anything over $100, sure, I'll use a credit or debit card. Under $100 it's going to be plain ol' cash.
Just cruising through this digital world at 33 1/3 rpm...
Why do any of these companies store your CC information? Surely it's only needed to authorize the transaction, do they need it for more than that?
When if the FTC going to start imposing fines so that these companies take the security of peoples personal and financial info seriously?
As far the the kiosks.. we have seen a lot of those pop up here and there across LA here. They have all died to be taken away to a junk yard.
For kiosks to succeed they better be built into every table and have smartphone integration. Possibly with siri or cortana to take my order.
Back around October 15, 2015, the credit card industry was pushing for all credit card issuers to provide cards with a chip embedded (called EMV credit cards) and merchants to switch to using equipment to read the chip. Since the card is inserted into the unit instead of swiped passed a magnetic reader, the new method of providing the credit card for a transaction is called dipping. There was a bunch of claims being thrown around about the amount of reduction in fraud would result.
So, if these hacks happened after October of last year, why is this still an issue? Where exactly are we with the grand shift to the wonderful sluggish world of dipping?
Minimum wage register jockies can only steal from one customer at a time.
Replace them with automatation because minimum wage went up, and now haxxors can steal from ALL YOUR CUSTOMERS!
Still better than eating at Chipolte.
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
Wasn't this past the liability deadline for Chip transactions? I'm guessing Wendy's and not the Bank will be responsible for any fraudulent transactions due to this hack?
I wonder if credit monitoring companies secretly fund these hacks.
I think this was already reported a few months ago... nice job ABC News... what's next? LinkedIn suffered a data breach? or is it MySpace?
How many times have we heard about tens of thousands, millions, of people having their data stolen/purloined/misappropriated/whatever because of private industry? Anyone remember the millions who were affected by the Target fiasco? How about T.J. Maxx? Barely a murmur is heard.
Yet let a few thousand people have their data swiped through a government breach and people go apoplectic.
Based on the evidence it appears government is doing substantially better than private industry in protecting our data.
We will bankrupt ourselves in the vain search for absolute security. -- Dwight D. Eisenhower
Yet let a few thousand people have their data swiped through a government breach and people go apoplectic.
Based on the evidence it appears government is doing substantially better than private industry in protecting our data.
I might need a new debit card. What a pain. If you have government clearance, thanks to the OPM breach, the Chinese have all of your biometric data. Game over.
The Wendy's breach can be fixed with a bunch of new cards. The government breach cannot be fixed.
That is why people were apoplectic.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
"One year of free credit monitoring" is the corporate equivalent to the "Thoughts and Prayers" fecal spray from gutless politicians after every gun-driven US mass murder.
"Dipping" is a stupid fucking term that only Americans could come up with, and only because Americans are so averse to change and need a cute term to lessen their fear.
The rest of the world is fine with inserting their cards like they've been doing for years. If an American ever tells me to dip my card, I'll tell them rightly to fuck off.
Surely it was 1024 restaurants.
I went to america earlier this year and was shocked that there was virtually no implementation of chip and pin. It felt like i went back in time.
I am honestly surprised a day goes by where there is not massive credit card fraud in the US. I swiped my card everywhere and the only check on that was my signature! the merchant is not protected at all!
These kinds of skimming breaches are a direct result of not having chip and pin everywhere. Sure they can install a camera to grab your pin, but that is a bit more involved then simply skimming credit cards. Most POS with chip and pin is end to end encrypted as well and has only the most basic of interaction. The hardware chip in the pinpad does all the encrypt and decrypt stuff. Don't you guys have to do that for PCI compliance anyway?
I'm sure you have chip and pin on debit cards, so why all the fuss about credit card implementation? All the posts thus far are saying things like "thats why i pay with cash" which is completely backwards in mentality. Jesus cash? who carries cash?? next thing you tell me is you walk around with a pocket full of change like its the 1970s!
Unless your buying drugs, or doing craigslist deals, i fail to see the point of cash transactions. Change and cash gets lost or spent way easier than a debit card. Well for me anyway.
-
Oh there is. It's called chip and pin. There is no requirement for any retailer to hold credit card information for over the counter transactions.
As long as you keep hiding behind your "cyber" bogeymen, there'll be no real security in computing.
The OPM breach affected 21.5 million people and it included social security numbers, names, addresses, dates of birth, fingerprints, and security clearance details.
..buy an icecream with a credit card? I mean, Wendy's has only two products: soft service ice-cream and hot-dogs, and I'm pretty sure I'm the only person on the planet who buys their hotdogs. Something is very fishy about this story. Also, why are we calling these 'restaurants' now? They are a kiosk at most.
CASH. For trivial, small-amount transactions that will not be returned (i.e., fast food), I LOVE CASH. I never get charged twice for the same thing. Never a problem with the tip amount, etc. And no exposure for hacks like this.
Granted, I haven't had many problems with credit card transactions, but I've had ZERO problems with cash.
Dear Slashdot: next time you want to mess with the site, add a rich-text editor for comments.
I just called Wendy's hotline as my local restaurant was hacked. During the time the location was vulnerable and I had been a customer, I had two attempts at fraudulent charges and one actual incident. My bank issued new credit cards after each and waived the charges of the third incident. My current credit card was used at Wendy's during the store's period of vulnerability but has not been used fraudulently, yet. I called to obtain the one year of complimentary fraud consultation and identity restoration services. As with past companies (Target, Vudu) I have done business with who had been hacked and offered some remediation, I received one year of free credit monitoring. Wendy's is not offering that. They will offer consultation and identity restoration services should your identity be stolen AND you are a victim of such fraud. They are relying on their victimized customers to be vigilant and deal directly with their credit card issuers for all fraudulent charges. These are not their problems. You must be a verified victim of the crime of identity theft, with in one year of Wendy's compromise, before they will lift a finger. If someone used my credit card information, stolen while in the possession of Wendy's, at anytime in the future Wendy's will not accept responsibility and will leave me exposed to the outcome of an investigation by my credit card issuer.
How's that for a Wendy's hot and juicy?
I used to work for Wand Corporation (POS in every sense of the word), and several wendy's stores that I know used their system are on the list of sites that had a breach.
This comes as no surprise to me.
When I worked there many years ago storing credit card numbers in log files was standard practice, social security numbers of employees were also stored in plain text in an access database, the security for those system was laughable.
After I quit I found my access was still enabled months later when I went to remove their VPN client from my machine.
They also had a "Store and forward" feature for processing credit cards when the internet was down, so credit card information could be captured, and then processed when the connection was back up.
They have a history of pushing out untested patches and updates, and once took the credit card processing for nearly every Wendy's store they used down in one fell swoop, took the support center the better part of two days to get the systems all back up.
They used remote access software that was freeware, and hadn't been updated for a decade. They were hit hard by blaster and sasser because they didn't have and sort of firewall enabled, and when windows XP SP2 turned on the firewall by default they advised people turn it off because it was causing issues with their software...
Your love of government is at odds with your sig.
Gamingmuseum.com: Give your 3D accelerator a rest.
I've never understood this part of it all, the credit card holder doesn't have to pay, the retailer often keeps the money, so it's a loss for the credit card company, but they never seem to concerned by the losses they take, or at least I never see anyone going into it on the internet or news.
Either they lied about it for months, or were still clueless about the actual extent FOR MONTHS, after being made aware that they'd been pwned. I'm not sure which is worse, but either way... aslholes.
I was quite impressed with the site sharing which locations were affected. I understand security is the mitigation of risk, not the absolute prevention of risk, and I appreciate their attempts to be so open with their customers. I suppose that due to all the other breaches everywhere else in the world, I have enough credit monitoring for quite a while, so I don't need this one too.
All of these breaches are being publicized and outed by the companies because they can then offload responsibility back to you to have your cards changed and account numbers changed, etc, without having to put out much in revenue to mitigate the issue. The corporations are still shifting the onus onto the customer. While they make take some action, they are all attempting to mitigate the fallout with these revelations. As such, they are all waiting until the breaches occur and then doing something rather than taking preemptive steps to stop the problem from occurring in the first place. They still need to be punished properly each and every time to make this behavior disappear.
Sometimes it's beneficial http://www.newser.com/story/21...