Attacks/Breaches
1/16/2013
04:21 PM
Connect Directly
RSS
E-Mail
50%
50%

Zaxby's Restaurants Hit With Security Breach

The restaurant chain is investigating a breach that may have exposed customer data at more than 100 of its locations

The chicken food chain Zaxby's is warning customers that hackers may have compromised customer credit-card data at locations throughout the country.

According to the company, suspicious files were identified on computer systems at several of the chain's restaurants in places as varied as Florida, Alabama, and Georgia. All told, roughly 100 locations are listed as possibly affected. The company did not say when or how exactly the chain locations were hacked, and it did not respond to a request for more information before publication.

However, in an interview with CRN, Blake Bailey, chief financial officer for Zaxby's, says the firm was told Nov. 9 by one of its credit-card processors that potentially fraudulent activity had been traced to some of the company's restaurants. According to the CRN report, the malware was not on the point-of-sale systems at the restaurants, making this breach different from recent attacks on Barnes & Noble and other retailers. Instead, Bailey tells CRN, the malware was found on hard drives on computers located at the restaurants.

"Although the forensic investigation has not determined whether credit or debit card data left the processing systems of any of the locations, Zaxby’s Franchising, Inc. is concerned that the existence of the suspicious files could indicate that an attacker or attackers may have accessed data, including credit and debit card information," according to a statement from the company.

In its 2012 data breach investigations report, Verizon found that in 2011, the food industry was one of the hardest hit sectors, representing 54 percent of all data breaches investigated by the company.

Tom Cross, director of security researcher at Lancope, says Zaxby's was right to be proactive in notifying customers.

'When you discover a malware infection on a computer system that contains sensitive information, it is appropriate to operate under the assumption that the sensitive information may have been stolen and take appropriate action, unless you can completely eliminate that possibility," Cross says.

The company also says it is working with all of its store locations to implement additional security measures to prevent future breaches.

"Zaxby’s Franchising, Inc. has notified appropriate law enforcement authorities of the potential criminal activity, which is believed to have originated from external sources, and will continue to cooperate with any investigation of this situation," according to the company's statement.

The restaurant chain was founded in 1990 and today operates in 13 states, including Alabama, Arkansas, Florida, Georgia, Indiana, Kentucky, Louisiana, Mississippi, North Carolina, South Carolina, Tennessee, Texas, and Virginia.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Must Reads - September 25, 2014
Dark Reading's new Must Reads is a compendium of our best recent coverage of identity and access management. Learn about access control in the age of HTML5, how to improve authentication, why Active Directory is dead, and more.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-5485
Published: 2014-09-30
registerConfiglet.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via unspecified vectors, related to the admin interface.

CVE-2012-5486
Published: 2014-09-30
ZPublisher.HTTPRequest._scrubHeader in Zope 2 before 2.13.19, as used in Plone before 4.3 beta 1, allows remote attackers to inject arbitrary HTTP headers via a linefeed (LF) character.

CVE-2012-5487
Published: 2014-09-30
The sandbox whitelisting function (allowmodule.py) in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with certain privileges to bypass the Python sandbox restriction and execute arbitrary Python code via vectors related to importing.

CVE-2012-5488
Published: 2014-09-30
python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via a crafted URL, related to createObject.

CVE-2012-5489
Published: 2014-09-30
The App.Undo.UndoSupport.get_request_var_or_attr function in Zope before 2.12.21 and 3.13.x before 2.13.11, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote authenticated users to gain access to restricted attributes via unspecified vectors.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
In our next Dark Reading Radio broadcast, we’ll take a close look at some of the latest research and practices in application security.