Slashdot Mirror
Pizza Hut Leaks Credit Card Info On 60,000 Customers (kentucky.com)
An anonymous reader quotes McClatchy:
Pizza Hut told customers by email on Saturday that some of their personal information may have been compromised. Some of those customers are angry that it took almost two weeks for the fast food chain to notify them. According to a customer notice emailed from the pizza chain, those who placed an order on its website or mobile app between the morning of Oct. 1 and midday Oct. 2 might have had their information exposed. The "temporary security intrusion" lasted for about 28 hours, the notice said, and it's believed that names, billing ZIP codes, delivery addresses, email addresses and payment card information -- meaning account number, expiration date and CVV number -- were compromised... A call center operator told McClatchy that about 60,000 people across the U.S. were affected.
"[W]e estimate that less than one percent of the visits to our website over the course of the relevant week were affected," read a customer notice sent only to those affected, offering them a free year of credit monitoring. But that hasn't stopped sarcastic tweets like this from the breach's angry victims.
"Hey @pizzahut, thanks for telling me you got hacked 2 weeks after you lost my cc number. And a week after someone started using it."
"[W]e estimate that less than one percent of the visits to our website over the course of the relevant week were affected," read a customer notice sent only to those affected, offering them a free year of credit monitoring. But that hasn't stopped sarcastic tweets like this from the breach's angry victims.
"Hey @pizzahut, thanks for telling me you got hacked 2 weeks after you lost my cc number. And a week after someone started using it."
And folks, that's why cash is best.
Credit cards are nothing but evil. Although, if you want to travel, you can't live without them.
Credit is just an evil. There's very little good about it - for consumers.
Now, business credit is called "leverage" and that's a whole different issue.
But for Joe Public, credit cards should just be outlawed. Just destroy them and their business. If it weren't for them, much of our economic dysfunction wouldn't exist. It just distorts everything....
But I need stuffed crust pizza you fuck. Are you gonna make it for me? Are you?!?
Your loss is limited. And anyone eating at the Hut doesn't know what good pizza tastes like.
I'm pretty sure the information that can be gleaned from a Pizza Hut customer is not exactly going to make a cyber criminal rich.
No. You dont need it.
I need it! Either you get me my stuffed crust or you get on your knees and Instuff your crust. Now what's it gonna be?!?
If this causes them to stop shoveling pizza down their pie holes for a few days it's a good thing. Not to mention Pizza Hut "pizza"
(gets on knees, opens mouth wide)
Do what you must, stuff my crust.
All their food tastes like shit now. They cheapened things up and tried to make them healthier. Give me that greasy food they used to make in the 90s.
That number is very low for a nationwide chain. Thats the customers in like one town.
As always, shrug and watch your statements. Your CC info is out there somewhere.
on some machine that it capable of being cracked ? Once they have sought payment from the credit card company - why do they keep the CVV number ? If, for some reason, they really need to (eg: easy next order), then keep all that sensitive information on some machine with a very narrow API (eg: charge customer 1234 $20 - tell me if this is approved). Many problem could be, at least partly, mitigated if they did not store everything in one big damn SQL database!
If you're eating at Pizza Hut, you've got bigger problems in your life than getting your credit card number stolen again.
I don't respond to AC's.
According to the article, it affected fewer than 1% of customers that weekend, the intrusion was stopped within 28 hours, and they've called in outside experts to take an objective look at it and help them improve their security posture. They did get hacked, AND they are doing some things right.
It looks like they had some monitoring in place that caught it - good.
They are getting assistance from security professionals - good.
Those professionals don't work for the same internal IT department that had a deficiency in the first place - good.
The fact that they got hacked means there were several things wrong. They should have had multiple layers of security. Yet they are also doing some things right.
Right? That's so BS, 2 weeks is great time. Equifux waited half a year then kept lying.
Oh they will get fined if anything at all and fines do not work when it comes to businesses, just a cost of doing business because it is cheaper than being up to code. The only successful deterrent would be to revoke the corporate charter then arrest the top execs and put them in prison along with the poor white and black "trash".
1- Never save credit card with a merchant.
2- Never accept privacy statements for a false feeling of security since they can't be trusted anyway. Always assume everything will be leaked intentional or through gaping security holes.
3- Do not create accounts on websites or with merchants. If needed, just go to another website to make that purchase as a guest.
4- For any account, choose a different and safe password and add 2f authentication if available. This offers no guarantee in anyway but at least let's close the doors that can be closed.
5- Limit or eliminate any subscriptions (Apple, Netflix, Microsoft, etc).
6- Do not make your Facebook profile public, including your profile picture, or post anything public and make it easy for identity thieves. If possible, do not use Facebook (or Google+).
7- Limit social account friends to the minimum. If posting something controversial and it's shared (maybe goes viral), these are not your friends.
8- Do not answer phone calls from callerids not in the contacts list. Let go to voicemail.
Aside from credit card payments, many people need to share their bank routing information for at least home rent and/or home utilities for monthly "pull" payments. Unfortunately, in the US most people are sitting financial ducks in one or more ways..
In fact, treat them the same way SMERSH kept trying to treat James Bond. Death To Spies!
davecb@spamcop.net
haha yup, those librul snowflakes amirite?? haha... not like us conservative REAL MEN haha?
caught in the Equifax hack?
And how much bigger was the Equifax hack than the PH one?
Given that it took... 5 years for the Yahoo hack, and 3(?) years for the Equifax hack compromised customers information to be documented and released, I would say pizza hut did their due diligence far better than some of the 'industry leading professionals' have.
Good job Pizza Hut. You may have fucked a bunch of your customers, but you did it with the tip, not the shaft, like your compatriots! :)
amazing
The future is everyone giving up and buying cyber-loss insurance. My house doesn't have to be a fortress with me guarding it 24/7 to get homeowner's insurance. The same level of practicality and get-on-with-your-life thinking needs to come to all of this cyber-security business.
Strange things are afoot at the Circle-K.
Your personal and financial information has already been stolen, whether the company holding your data has admitted it or not (or more to the point, regardless of whether they even *know it* or not). And if it hasn't yet, it will be. Count on it.
Your information is not stored safely, period. Just accept it, move on and conduct yourself accordingly. It's a fact of life these days.
Palaces, barricades, threats, meet promises
I think we've seen enough stories of this kind to know that businesses lie about the extent of the loss of control of relevant systems and by default we should not believe them their first report. We've even seen these kinds of stories repeated on /. recently:
If you think this is the beginning and ending of this story, you have not been paying attention.
What to do about it? Using cash is a short-term solution for a narrow problem but doesn't address the de-anonymization efforts underway for cash (unique IDs embedded in paper currency, for instance) and doesn't address whether we should trust Pizza Hut or Yum! Brands at all.
If we think like legislatures apparently do regarding drug law, copyright law, and so on then the ugly patterns have formed and it's time get punitive (just as they apparently do at the behest of big businesses against the wishes of the citizenry). Tell big businesses that they stand to be disincorporated when they lose exclusive access to their systems or hire other businesses that lose said exclusive access because we value not being defrauded more than we value their lax business practices. We also need to remain vigilant over credit law and make sure that liability is always limited to some low value and always kept in place for the credit user. We should never stand for credit card processors of any kind making it easier to move the liability for fraud to the end user.
Digital Citizen
... the first question this post raised was, "Pizza Hut has customers?"
// This is not a sig.
The response is good, but the funny thing is that I have long refused to let them store my CC number because the password policy they have is insane. I can't remember what it is right now, but I think they wouldn't let you use most symbols or spaces and had a really short maximum length.
I figured that anyone who would force their customers to use laughably weak passwords had poor internal security. I'm glad to see their response is better than I would've expected, but the fact that they got cracked does not surprise me at all. Fortunately, all they have is my address.
From Wikipedia:
"As a security measure, merchants who require the CVV2 for "card not present" payment card transactions are required by the card issuer not to store the CVV2 once the individual transaction is authorized.[6] This way, if a database of transactions is compromised, the CVV2 is not included, and the stolen card numbers are less useful. Virtual terminals and payment gateways do not store the CVV2 code, therefore employees and customer service representatives with access to these web-based payment interfaces who otherwise have access to complete card numbers, expiration dates, and other information still lack the CVV2 code.
The Payment Card Industry Data Security Standard (PCI DSS) also prohibits the storage of CSC (and other sensitive authorisation data) post transaction authorisation. This applies globally to anyone who stores, processes or transmits card holder data.[7] "
So, considering that, what happens now? Pizza Hut should have their merchant license revoked and no longer accept credit card payments.
Having your personal info stolen or others finding out that you ate at Pizza Hut. They both seem pretty terrible.
People are complaining about a two week delay? Experian waited MONTHS, involved FAR more people and exposed much more sensitive information before they finally came clean (and after their execs dumped some stock).
About 4 months ago I stopped using plastic for everything and started using cash as much as possible because of constant security breaches like this one. I'm recommending in the strongest words possible that everyone do the same, unless you really want to continually expose yourself to the threat of having your bank accounts drained and/or credit cards maxed out and/or identity stolen. The more you use plastic the more exposed you are and there's no getting around that anymore, and the situation is not going to improve until they find a way to prevent these incursions from happening in the first place. At this point in time the minimal risk of maybe getting mugged for $100 in your wallet is far less than getting your entire LIFE 'virtually mugged' by some cybercriminal organization that rapes all your accounts and rapes you for your identity, ruining your life completely.
Makes one think of Domino's Pizza would be good to get a Domino's Pizza in North Walsham, Norfolk, Britain.
People forget that almost every single credit card transaction is done via a very small number of 3rd party processors.
But do you see the name of the processing company anywhere in this reports?
How much you want to bet that most of the breaches can be tracked back to a single processing company?