Slashdot Mirror
Pizza Hut Leaks Credit Card Info On 60,000 Customers (kentucky.com)
An anonymous reader quotes McClatchy:
Pizza Hut told customers by email on Saturday that some of their personal information may have been compromised. Some of those customers are angry that it took almost two weeks for the fast food chain to notify them. According to a customer notice emailed from the pizza chain, those who placed an order on its website or mobile app between the morning of Oct. 1 and midday Oct. 2 might have had their information exposed. The "temporary security intrusion" lasted for about 28 hours, the notice said, and it's believed that names, billing ZIP codes, delivery addresses, email addresses and payment card information -- meaning account number, expiration date and CVV number -- were compromised... A call center operator told McClatchy that about 60,000 people across the U.S. were affected.
"[W]e estimate that less than one percent of the visits to our website over the course of the relevant week were affected," read a customer notice sent only to those affected, offering them a free year of credit monitoring. But that hasn't stopped sarcastic tweets like this from the breach's angry victims.
"Hey @pizzahut, thanks for telling me you got hacked 2 weeks after you lost my cc number. And a week after someone started using it."
"[W]e estimate that less than one percent of the visits to our website over the course of the relevant week were affected," read a customer notice sent only to those affected, offering them a free year of credit monitoring. But that hasn't stopped sarcastic tweets like this from the breach's angry victims.
"Hey @pizzahut, thanks for telling me you got hacked 2 weeks after you lost my cc number. And a week after someone started using it."
And folks, that's why cash is best.
Credit cards are nothing but evil. Although, if you want to travel, you can't live without them.
Credit is just an evil. There's very little good about it - for consumers.
Now, business credit is called "leverage" and that's a whole different issue.
But for Joe Public, credit cards should just be outlawed. Just destroy them and their business. If it weren't for them, much of our economic dysfunction wouldn't exist. It just distorts everything....
I'm pretty sure the information that can be gleaned from a Pizza Hut customer is not exactly going to make a cyber criminal rich.
I need it! Either you get me my stuffed crust or you get on your knees and Instuff your crust. Now what's it gonna be?!?
(gets on knees, opens mouth wide)
Do what you must, stuff my crust.
All their food tastes like shit now. They cheapened things up and tried to make them healthier. Give me that greasy food they used to make in the 90s.
That number is very low for a nationwide chain. Thats the customers in like one town.
As always, shrug and watch your statements. Your CC info is out there somewhere.
Do the banks go after Pizza Hut for their losses?
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
on some machine that it capable of being cracked ? Once they have sought payment from the credit card company - why do they keep the CVV number ? If, for some reason, they really need to (eg: easy next order), then keep all that sensitive information on some machine with a very narrow API (eg: charge customer 1234 $20 - tell me if this is approved). Many problem could be, at least partly, mitigated if they did not store everything in one big damn SQL database!
According to the article, it affected fewer than 1% of customers that weekend, the intrusion was stopped within 28 hours, and they've called in outside experts to take an objective look at it and help them improve their security posture. They did get hacked, AND they are doing some things right.
It looks like they had some monitoring in place that caught it - good.
They are getting assistance from security professionals - good.
Those professionals don't work for the same internal IT department that had a deficiency in the first place - good.
The fact that they got hacked means there were several things wrong. They should have had multiple layers of security. Yet they are also doing some things right.
Tell you what then: Post your CC details here, and I'll go eat at Pizza Hut tonight. We can touch base again here week to see how we're both doing.
In fact, treat them the same way SMERSH kept trying to treat James Bond. Death To Spies!
davecb@spamcop.net
The future is everyone giving up and buying cyber-loss insurance. My house doesn't have to be a fortress with me guarding it 24/7 to get homeowner's insurance. The same level of practicality and get-on-with-your-life thinking needs to come to all of this cyber-security business.
Strange things are afoot at the Circle-K.
Your personal and financial information has already been stolen, whether the company holding your data has admitted it or not (or more to the point, regardless of whether they even *know it* or not). And if it hasn't yet, it will be. Count on it.
Your information is not stored safely, period. Just accept it, move on and conduct yourself accordingly. It's a fact of life these days.
Palaces, barricades, threats, meet promises
Do the banks go after Pizza Hut for their losses?
No. They go after the merchants that accepted the fraudulent transactions. If you run an online business, and you accept "card not present" transactions, then you are SOL if the bank issues a chargeback. You can verify the address, or at least the zipcode, to cut down on fraud, or you can just eat the loss as a cost of doing business. Either way, there are no "losses" for the bank. That is why they have no incentive to fix the system. It is not their problem.
I think we've seen enough stories of this kind to know that businesses lie about the extent of the loss of control of relevant systems and by default we should not believe them their first report. We've even seen these kinds of stories repeated on /. recently:
If you think this is the beginning and ending of this story, you have not been paying attention.
What to do about it? Using cash is a short-term solution for a narrow problem but doesn't address the de-anonymization efforts underway for cash (unique IDs embedded in paper currency, for instance) and doesn't address whether we should trust Pizza Hut or Yum! Brands at all.
If we think like legislatures apparently do regarding drug law, copyright law, and so on then the ugly patterns have formed and it's time get punitive (just as they apparently do at the behest of big businesses against the wishes of the citizenry). Tell big businesses that they stand to be disincorporated when they lose exclusive access to their systems or hire other businesses that lose said exclusive access because we value not being defrauded more than we value their lax business practices. We also need to remain vigilant over credit law and make sure that liability is always limited to some low value and always kept in place for the credit user. We should never stand for credit card processors of any kind making it easier to move the liability for fraud to the end user.
Digital Citizen
... the first question this post raised was, "Pizza Hut has customers?"
// This is not a sig.
The response is good, but the funny thing is that I have long refused to let them store my CC number because the password policy they have is insane. I can't remember what it is right now, but I think they wouldn't let you use most symbols or spaces and had a really short maximum length.
I figured that anyone who would force their customers to use laughably weak passwords had poor internal security. I'm glad to see their response is better than I would've expected, but the fact that they got cracked does not surprise me at all. Fortunately, all they have is my address.
From Wikipedia:
"As a security measure, merchants who require the CVV2 for "card not present" payment card transactions are required by the card issuer not to store the CVV2 once the individual transaction is authorized.[6] This way, if a database of transactions is compromised, the CVV2 is not included, and the stolen card numbers are less useful. Virtual terminals and payment gateways do not store the CVV2 code, therefore employees and customer service representatives with access to these web-based payment interfaces who otherwise have access to complete card numbers, expiration dates, and other information still lack the CVV2 code.
The Payment Card Industry Data Security Standard (PCI DSS) also prohibits the storage of CSC (and other sensitive authorisation data) post transaction authorisation. This applies globally to anyone who stores, processes or transmits card holder data.[7] "
So, considering that, what happens now? Pizza Hut should have their merchant license revoked and no longer accept credit card payments.
Having your personal info stolen or others finding out that you ate at Pizza Hut. They both seem pretty terrible.
About 4 months ago I stopped using plastic for everything and started using cash as much as possible because of constant security breaches like this one. I'm recommending in the strongest words possible that everyone do the same, unless you really want to continually expose yourself to the threat of having your bank accounts drained and/or credit cards maxed out and/or identity stolen. The more you use plastic the more exposed you are and there's no getting around that anymore, and the situation is not going to improve until they find a way to prevent these incursions from happening in the first place. At this point in time the minimal risk of maybe getting mugged for $100 in your wallet is far less than getting your entire LIFE 'virtually mugged' by some cybercriminal organization that rapes all your accounts and rapes you for your identity, ruining your life completely.