Attacks/Breaches
1/16/2013
04:21 PM
50%
50%

Zaxby's Restaurants Hit With Security Breach

The restaurant chain is investigating a breach that may have exposed customer data at more than 100 of its locations

The chicken food chain Zaxby's is warning customers that hackers may have compromised customer credit-card data at locations throughout the country.

According to the company, suspicious files were identified on computer systems at several of the chain's restaurants in places as varied as Florida, Alabama, and Georgia. All told, roughly 100 locations are listed as possibly affected. The company did not say when or how exactly the chain locations were hacked, and it did not respond to a request for more information before publication.

However, in an interview with CRN, Blake Bailey, chief financial officer for Zaxby's, says the firm was told Nov. 9 by one of its credit-card processors that potentially fraudulent activity had been traced to some of the company's restaurants. According to the CRN report, the malware was not on the point-of-sale systems at the restaurants, making this breach different from recent attacks on Barnes & Noble and other retailers. Instead, Bailey tells CRN, the malware was found on hard drives on computers located at the restaurants.

"Although the forensic investigation has not determined whether credit or debit card data left the processing systems of any of the locations, Zaxby’s Franchising, Inc. is concerned that the existence of the suspicious files could indicate that an attacker or attackers may have accessed data, including credit and debit card information," according to a statement from the company.

In its 2012 data breach investigations report, Verizon found that in 2011, the food industry was one of the hardest hit sectors, representing 54 percent of all data breaches investigated by the company.

Tom Cross, director of security researcher at Lancope, says Zaxby's was right to be proactive in notifying customers.

'When you discover a malware infection on a computer system that contains sensitive information, it is appropriate to operate under the assumption that the sensitive information may have been stolen and take appropriate action, unless you can completely eliminate that possibility," Cross says.

The company also says it is working with all of its store locations to implement additional security measures to prevent future breaches.

"Zaxby’s Franchising, Inc. has notified appropriate law enforcement authorities of the potential criminal activity, which is believed to have originated from external sources, and will continue to cooperate with any investigation of this situation," according to the company's statement.

The restaurant chain was founded in 1990 and today operates in 13 states, including Alabama, Arkansas, Florida, Georgia, Indiana, Kentucky, Louisiana, Mississippi, North Carolina, South Carolina, Tennessee, Texas, and Virginia.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-2184
Published: 2015-03-27
Movable Type before 5.2.6 does not properly use the Storable::thaw function, which allows remote attackers to execute arbitrary code via the comment_state parameter.

CVE-2014-3619
Published: 2015-03-27
The __socket_proto_state_machine function in GlusterFS 3.5 allows remote attackers to cause a denial of service (infinite loop) via a "00000000" fragment header.

CVE-2014-8121
Published: 2015-03-27
DB_LOOKUP in nss_files/files-XXX.c in the Name Service Switch (NSS) in GNU C Library (aka glibc or libc6) 2.21 and earlier does not properly check if a file is open, which allows remote attackers to cause a denial of service (infinite loop) by performing a look-up while the database is iterated over...

CVE-2014-9712
Published: 2015-03-27
Websense TRITON V-Series appliances before 7.8.3 Hotfix 03 and 7.8.4 before Hotfix 01 allows remote administrators to read arbitrary files and obtain passwords via a crafted path.

CVE-2015-0658
Published: 2015-03-27
The DHCP implementation in the PowerOn Auto Provisioning (POAP) feature in Cisco NX-OS does not properly restrict the initialization process, which allows remote attackers to execute arbitrary commands as root by sending crafted response packets on the local network, aka Bug ID CSCur14589.

Dark Reading Radio
Archived Dark Reading Radio
Good hackers--aka security researchers--are worried about the possible legal and professional ramifications of President Obama's new proposed crackdown on cyber criminals.