Attacks/Breaches
1/16/2013
04:21 PM
Connect Directly
RSS
E-Mail
50%
50%

Zaxby's Restaurants Hit With Security Breach

The restaurant chain is investigating a breach that may have exposed customer data at more than 100 of its locations

The chicken food chain Zaxby's is warning customers that hackers may have compromised customer credit-card data at locations throughout the country.

According to the company, suspicious files were identified on computer systems at several of the chain's restaurants in places as varied as Florida, Alabama, and Georgia. All told, roughly 100 locations are listed as possibly affected. The company did not say when or how exactly the chain locations were hacked, and it did not respond to a request for more information before publication.

However, in an interview with CRN, Blake Bailey, chief financial officer for Zaxby's, says the firm was told Nov. 9 by one of its credit-card processors that potentially fraudulent activity had been traced to some of the company's restaurants. According to the CRN report, the malware was not on the point-of-sale systems at the restaurants, making this breach different from recent attacks on Barnes & Noble and other retailers. Instead, Bailey tells CRN, the malware was found on hard drives on computers located at the restaurants.

"Although the forensic investigation has not determined whether credit or debit card data left the processing systems of any of the locations, Zaxby’s Franchising, Inc. is concerned that the existence of the suspicious files could indicate that an attacker or attackers may have accessed data, including credit and debit card information," according to a statement from the company.

In its 2012 data breach investigations report, Verizon found that in 2011, the food industry was one of the hardest hit sectors, representing 54 percent of all data breaches investigated by the company.

Tom Cross, director of security researcher at Lancope, says Zaxby's was right to be proactive in notifying customers.

'When you discover a malware infection on a computer system that contains sensitive information, it is appropriate to operate under the assumption that the sensitive information may have been stolen and take appropriate action, unless you can completely eliminate that possibility," Cross says.

The company also says it is working with all of its store locations to implement additional security measures to prevent future breaches.

"Zaxby’s Franchising, Inc. has notified appropriate law enforcement authorities of the potential criminal activity, which is believed to have originated from external sources, and will continue to cooperate with any investigation of this situation," according to the company's statement.

The restaurant chain was founded in 1990 and today operates in 13 states, including Alabama, Arkansas, Florida, Georgia, Indiana, Kentucky, Louisiana, Mississippi, North Carolina, South Carolina, Tennessee, Texas, and Virginia.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-1927
Published: 2014-10-25
The shell_quote function in python-gnupg 0.3.5 does not properly quote strings, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using "$(" command-substitution sequences, a different vulnerability than CVE-2014-1928....

CVE-2014-1928
Published: 2014-10-25
The shell_quote function in python-gnupg 0.3.5 does not properly escape characters, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using "\" (backslash) characters to form multi-command sequences, a different vulner...

CVE-2014-1929
Published: 2014-10-25
python-gnupg 0.3.5 and 0.3.6 allows context-dependent attackers to have an unspecified impact via vectors related to "option injection through positional arguments." NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7323.

CVE-2014-3409
Published: 2014-10-25
The Ethernet Connectivity Fault Management (CFM) handling feature in Cisco IOS 12.2(33)SRE9a and earlier and IOS XE 3.13S and earlier allows remote attackers to cause a denial of service (device reload) via malformed CFM packets, aka Bug ID CSCuq93406.

CVE-2014-3636
Published: 2014-10-25
D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8 allows local users to (1) cause a denial of service (prevention of new connections and connection drop) by queuing the maximum number of file descriptors or (2) cause a denial of service (disconnect) via multiple messages that combine to...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.