Slashdot Mirror
Arby's Probes Possible Data Breach Affecting 355,000 Credit Cards (krebsonsecurity.com)
Brian Krebs is reporting that Arby's "recently remediated a breach involving malicious software installed on payment card systems at hundreds of its restaurant locations nationwide." The breach is said to only affect some corporate stores and not franchised restaurant locations. While there is no exact number of those affected, it's possible that more than 355,000 credit and debit cards issued by PCSU members banks may have been compromised. Krebs On Security reports: The first clues about a possible breach at the sandwich chain came in a non-public alert issued by PSCU, a service organization that serves more than 800 credit unions. The alert sent to PSCU member banks advised that PSCU had just received very long lists of compromised card numbers from both Visa and MasterCard. The alerts stated that a breach at an unnamed retailer compromised more than 355,000 credit and debit cards issued by PCSU member banks. Arby's declined to say how long the malware was thought to have stolen credit and debit card data from infected corporate payment systems. But the PSCU notice said the breach is estimated to have occurred between Oct. 25, 2016 and January 19, 2017. Such a large alert from the card associations is generally a sign of a sizable nationwide breach, as this is likely just the first of many alerts Visa and MasterCard will send to card-issuing banks regarding accounts that were compromised in the intrusion. If history is any lesson, some financial institutions will respond by re-issuing thousands of customer cards, while other (likely larger) institutions will focus on managing fraud losses on the compromised cards.
Last night on the news there was also a story about some Arby's being picketed because they hadn't paid their employees. Are these guys asleep at the switch or something?
For all intensive purposes, "whom" is no longer a word. That begs the question, "who cares"?
the simpson's said it best: https://www.youtube.com/watch?...
We have THE BREACH!!
...also couldn't resist...
WE HAVE THE MALWARE!
Can we at least see a list of stores that were affected so I'd know if I need to take action?
Is that too much to ask?!
Yes, CC and banks are dragging their heels. But the whole system is just bad. First, why does Arby's have Normal CC information?? Once it passes, the deal is done. I get having corporate accounts on file, but this is silly. Second, the damn machines shouldn't be giving Arbys any information, other than transaction time/amount/ and some transaction code(needed for refunding cash). Third, The cards should be sophisticated enough to handle a secure chip/pin system (not the sad version of today, but one that is legit)
Not completely unrelated, but... Arby's charged me $87.80 for an $8.78. I noticed the incorrect charge a few days too late to dispute with my credit card company. I called the local store to find out THEY MANUALLY ENTER THE TOTALS in their credit card machines. Probably fat fingered the total. It's also common practice these days to withhold receipts (hence why I didn't notice right away). The GM and DM both acknowledge the problem, but 3 weeks after my first call I have yet to see a dime.
It's crazy these days that online shopping is a safer place to use your credit card than brick-and-mortar retailers and restaurants.
Yep, it is a recurring theme with credit cards isn't it?
Since there are absolutely no legal consequences, this kind of stuff is just going to keep happening.
Seven puppies were harmed during the making of this post.
It's probably the same 8 people who made all those transactions. Surprised that they even had that many sales! ;)
Chip-based cards will solve this kind of problem... the chip only surrenders enough data to process one transaction, so repeated transactions without the card present is impossible... would be nice if they rolled this out to the Internet too.
Which Arby's?
How does it only effect ards issued by one bank.if it was malware on the PoS machines?
The thieves likely stole numbers from any and all cards that ran through their infected payment terminals.
PCSU isn't a single bank, it's an association of about 800 credit unions. Arby's didn't report the number above, that came from PCSU's count of impacted member cards. They said 355,000 cards were impacted, a figure that does not include any other cards issued by any other banks. If those 800 member banks represent 10% of all cardholders (I don't know that for sure, that's just a rough guess to demonstrate the math), it's possible that this breach could impact a total of about 3 million cardholders.
John
I'm just impressed that there are 355,000 people who eat at Arby's
It's probably a money laundering scheme. I used to be sort of a regular at an Italian restaurant that never seemed to have many customers. The food wasn't bad at all and the staff actually spoke Italian. It was kind of fun to think that syndicate bosses were meeting behind the kitchen, but that would have probably been too much of a cliche, even for the mob. They probably run an Arby's instead.
Rememeber Breaking Bad? One of the biggest drug cartels in the world was run out of the back room of "Los Pollos Hermanos", a Mexican fast-food chain.