Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

12/31/2014
11:20 AM
Connect Directly
Twitter
RSS
E-Mail
100%
0%

Chick-fil-A Investigating Possible Data Breach

Suspicious activity seen with payment cards used at "a few" of its restaurants.

Fast food restaurant chain Chick-fil-A says it's working with law enforcement, the payment industry, and security firms to determine whether reports of suspicious activity with payment cards used at some of its restaurants were due to a data breach.

"Chick-fil-A recently received reports of potential unusual activity involving payment cards used at a few of our restaurants," the company said in a statement. "We want to assure our customers we are working hard to investigate these events and will share additional facts as we are able to do so."

If the investigation confirms there was a data breach, Chick-fil-A says its customers won't be responsible for fraudulent charges and will receive free credit monitoring services. "If the investigation reveals that a breach has occurred, customers will not be liable for any fraudulent charges to their accounts. Any fraudulent charges will be the responsibility of either Chick-fil-A or the bank that issued the card. If our customers are impacted, we will arrange for free identity protection services, including credit monitoring."

Reports of potential payment card fraud were first reported by KrebsOnSecurity yesterday. According to the blog, a major credit card association this month alerted some financial institutions of "an unnamed retailer" being breached between December 2, 2013, and September 30, 2014. A financial institution source told KrebsOnSecurity that some 9,000 of its issued customer cards were on the list, and their common link was transactions at Chick-fil-A restaurants.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
1/2/2015 | 10:57:55 AM
Re: Chick-Fil-A sustomers would be better off
The same can be said for many enterprises. Most are more likely to attempt reactive steps than be proactive and get onboard with the security initiative. That's where as security professionals we are tasked with providing value in proactive measures. To delineate why it is imperative to improve an enterprise security posture before an event ensues.

The enterprise ideology is equivalent to a child touching the stove. If they were to never be burnt during the process then without being taught why it is crucial not to touch the stove, there would be no reason for them to refrain from that action. In this case, if an enterprise has not been breached, in many cases, the enterprise has no burn factor and without outside intervention may see very little value in being proactive. Unfortunately with the organizations listed in this article it took them being burnt before realizing that there is value in employing security safeguards.
Darth Nul
100%
0%
Darth Nul,
User Rank: Strategist
12/31/2014 | 3:06:25 PM
Chick-Fil-A sustomers would be better off
if Chick-Fil-A spent their money on improving security rather than providing worthless "credit monitoring" services to affected customers.
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
12/31/2014 | 12:01:39 PM
Re: Vigilance
I would be interested to see the protocols for pursuing this. Since most banks do have a fraud response program, I am curious if this turns out to be a breach if Chick-fil-A's step one will be ask client if they called their bank first.
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
12/31/2014 | 11:44:16 AM
Re: Vigilance
Now you're making me hungry for lunch, @RyanSepe. =) Free credit monitoring services are a pretty standard offering by breached retailers. 

One thing I noticed about Chick-fil-A: their PR folks were quick to respond to my query.
RyanSepe
0%
100%
RyanSepe,
User Rank: Ninja
12/31/2014 | 11:38:32 AM
Vigilance
I knew there was a reason I liked Chick-fil-A. Other than their delcious sandwiches. It is good to see that a company is being vigilant to determine if they were part of a breach as well as providing a means of protection against fraudelant activity related to the breach.

Did any of the other retailers that had confirmed breaches in the previous years offer similar services?
More SolarWinds Attack Details Emerge
Kelly Jackson Higgins, Executive Editor at Dark Reading,  1/12/2021
Vulnerability Management Has a Data Problem
Tal Morgenstern, Co-Founder & Chief Product Officer, Vulcan Cyber,  1/14/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2020: The Year in Security
Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
Flash Poll
Assessing Cybersecurity Risk in Today's Enterprises
Assessing Cybersecurity Risk in Today's Enterprises
COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-36192
PUBLISHED: 2021-01-18
An issue was discovered in the Source Integration plugin before 2.4.1 for MantisBT. An attacker can gain access to the Summary field of private Issues (either marked as Private, or part of a private Project), if they are attached to an existing Changeset. The information is visible on the view.php p...
CVE-2020-36193
PUBLISHED: 2021-01-18
Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948.
CVE-2020-7343
PUBLISHED: 2021-01-18
Missing Authorization vulnerability in McAfee Agent (MA) for Windows prior to 5.7.1 allows local users to block McAfee product updates by manipulating a directory used by MA for temporary files. The product would continue to function with out-of-date detection files.
CVE-2020-28476
PUBLISHED: 2021-01-18
All versions of package tornado are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configura...
CVE-2020-28473
PUBLISHED: 2021-01-18
The package bottle from 0 and before 0.12.19 are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with defa...