Attacks/Breaches
1/16/2013
04:21 PM
Connect Directly
RSS
E-Mail
50%
50%

Zaxby's Restaurants Hit With Security Breach

The restaurant chain is investigating a breach that may have exposed customer data at more than 100 of its locations

The chicken food chain Zaxby's is warning customers that hackers may have compromised customer credit-card data at locations throughout the country.

According to the company, suspicious files were identified on computer systems at several of the chain's restaurants in places as varied as Florida, Alabama, and Georgia. All told, roughly 100 locations are listed as possibly affected. The company did not say when or how exactly the chain locations were hacked, and it did not respond to a request for more information before publication.

However, in an interview with CRN, Blake Bailey, chief financial officer for Zaxby's, says the firm was told Nov. 9 by one of its credit-card processors that potentially fraudulent activity had been traced to some of the company's restaurants. According to the CRN report, the malware was not on the point-of-sale systems at the restaurants, making this breach different from recent attacks on Barnes & Noble and other retailers. Instead, Bailey tells CRN, the malware was found on hard drives on computers located at the restaurants.

"Although the forensic investigation has not determined whether credit or debit card data left the processing systems of any of the locations, Zaxby’s Franchising, Inc. is concerned that the existence of the suspicious files could indicate that an attacker or attackers may have accessed data, including credit and debit card information," according to a statement from the company.

In its 2012 data breach investigations report, Verizon found that in 2011, the food industry was one of the hardest hit sectors, representing 54 percent of all data breaches investigated by the company.

Tom Cross, director of security researcher at Lancope, says Zaxby's was right to be proactive in notifying customers.

'When you discover a malware infection on a computer system that contains sensitive information, it is appropriate to operate under the assumption that the sensitive information may have been stolen and take appropriate action, unless you can completely eliminate that possibility," Cross says.

The company also says it is working with all of its store locations to implement additional security measures to prevent future breaches.

"Zaxby’s Franchising, Inc. has notified appropriate law enforcement authorities of the potential criminal activity, which is believed to have originated from external sources, and will continue to cooperate with any investigation of this situation," according to the company's statement.

The restaurant chain was founded in 1990 and today operates in 13 states, including Alabama, Arkansas, Florida, Georgia, Indiana, Kentucky, Louisiana, Mississippi, North Carolina, South Carolina, Tennessee, Texas, and Virginia.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3345
Published: 2014-08-28
The web framework in Cisco Transport Gateway for Smart Call Home (aka TG-SCH or Transport Gateway Installation Software) 4.0 does not properly check authorization for administrative web pages, which allows remote attackers to modify the product via a crafted URL, aka Bug ID CSCuq31503.

CVE-2014-3347
Published: 2014-08-28
Cisco IOS 15.1(4)M2 on Cisco 1800 ISR devices, when the ISDN Basic Rate Interface is enabled, allows remote attackers to cause a denial of service (device hang) by leveraging knowledge of the ISDN phone number to trigger an interrupt timer collision during entropy collection, leading to an invalid s...

CVE-2014-4199
Published: 2014-08-28
vm-support 0.88 in VMware Tools, as distributed with VMware Workstation through 10.0.3 and other products, allows local users to write to arbitrary files via a symlink attack on a file in /tmp.

CVE-2014-4200
Published: 2014-08-28
vm-support 0.88 in VMware Tools, as distributed with VMware Workstation through 10.0.3 and other products, uses 0644 permissions for the vm-support archive, which allows local users to obtain sensitive information by extracting files from this archive.

CVE-2014-0761
Published: 2014-08-27
The DNP3 driver in CG Automation ePAQ-9410 Substation Gateway allows remote attackers to cause a denial of service (infinite loop or process crash) via a crafted TCP packet.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
This episode of Dark Reading Radio looks at infosec security from the big enterprise POV with interviews featuring Ron Plesco, Cyber Investigations, Intelligence & Analytics at KPMG; and Chris Inglis & Chris Bell of Securonix.