Slashdot Mirror
Arby's Probes Possible Data Breach Affecting 355,000 Credit Cards (krebsonsecurity.com)
Brian Krebs is reporting that Arby's "recently remediated a breach involving malicious software installed on payment card systems at hundreds of its restaurant locations nationwide." The breach is said to only affect some corporate stores and not franchised restaurant locations. While there is no exact number of those affected, it's possible that more than 355,000 credit and debit cards issued by PCSU members banks may have been compromised. Krebs On Security reports: The first clues about a possible breach at the sandwich chain came in a non-public alert issued by PSCU, a service organization that serves more than 800 credit unions. The alert sent to PSCU member banks advised that PSCU had just received very long lists of compromised card numbers from both Visa and MasterCard. The alerts stated that a breach at an unnamed retailer compromised more than 355,000 credit and debit cards issued by PCSU member banks. Arby's declined to say how long the malware was thought to have stolen credit and debit card data from infected corporate payment systems. But the PSCU notice said the breach is estimated to have occurred between Oct. 25, 2016 and January 19, 2017. Such a large alert from the card associations is generally a sign of a sizable nationwide breach, as this is likely just the first of many alerts Visa and MasterCard will send to card-issuing banks regarding accounts that were compromised in the intrusion. If history is any lesson, some financial institutions will respond by re-issuing thousands of customer cards, while other (likely larger) institutions will focus on managing fraud losses on the compromised cards.
Should have used bitcoin.
Last night on the news there was also a story about some Arby's being picketed because they hadn't paid their employees. Are these guys asleep at the switch or something?
For all intensive purposes, "whom" is no longer a word. That begs the question, "who cares"?
Sorry, couldn't resist. :-
Here it is!
the simpson's said it best: https://www.youtube.com/watch?...
We have THE BREACH!!
...also couldn't resist...
WE HAVE THE MALWARE!
Can we at least see a list of stores that were affected so I'd know if I need to take action?
Is that too much to ask?!
Yes, CC and banks are dragging their heels. But the whole system is just bad. First, why does Arby's have Normal CC information?? Once it passes, the deal is done. I get having corporate accounts on file, but this is silly. Second, the damn machines shouldn't be giving Arbys any information, other than transaction time/amount/ and some transaction code(needed for refunding cash). Third, The cards should be sophisticated enough to handle a secure chip/pin system (not the sad version of today, but one that is legit)
to know if we're affected. Too much of the media's reporting is based on sensationalizing stories rather than reporting facts.
Not completely unrelated, but... Arby's charged me $87.80 for an $8.78. I noticed the incorrect charge a few days too late to dispute with my credit card company. I called the local store to find out THEY MANUALLY ENTER THE TOTALS in their credit card machines. Probably fat fingered the total. It's also common practice these days to withhold receipts (hence why I didn't notice right away). The GM and DM both acknowledge the problem, but 3 weeks after my first call I have yet to see a dime.
It's crazy these days that online shopping is a safer place to use your credit card than brick-and-mortar retailers and restaurants.
Since there are absolutely no legal consequences, this kind of stuff is just going to keep happening.
Seven puppies were harmed during the making of this post.
Makes sense as to why someone tried to charge 2k to my mastercard on Monday morning. We almost never go to Arbys but we did in early January one time...
It's probably the same 8 people who made all those transactions. Surprised that they even had that many sales! ;)
I was under the impression that anyone that eats at Arbys probably doesn't own a computer or knows how to operate one, so why would any of us care about this?
Chip-based cards will solve this kind of problem... the chip only surrenders enough data to process one transaction, so repeated transactions without the card present is impossible... would be nice if they rolled this out to the Internet too.
.. and a major hole in our credit card network.
Already received an email at 3:30pm eastern time from my bank telling me that my card may have been compromised and they will be sending me a new one and to expect receipt of it in 3 to 5 days....
How does it only effect ards issued by one bank.if it was malware on the PoS machines?
The thieves likely stole numbers from any and all cards that ran through their infected payment terminals.
PCSU isn't a single bank, it's an association of about 800 credit unions. Arby's didn't report the number above, that came from PCSU's count of impacted member cards. They said 355,000 cards were impacted, a figure that does not include any other cards issued by any other banks. If those 800 member banks represent 10% of all cardholders (I don't know that for sure, that's just a rough guess to demonstrate the math), it's possible that this breach could impact a total of about 3 million cardholders.
John
and the data breach is bad, too.