Data Breach

PoS systems infected in 1 in 20 Wendy’s stores, credit card exposed

The hack suffered by Wendy’s fast-food chain was bigger than thought, payment card data exposed in more than 1000 stores.

The hack suffered by Wendy’s fast-food chain was bigger than thought and exposed sensitive information, including credit card data.

Roughly one on three Wendy’s burger was hacked, a malware has infected PoS systems. Just after the hack, the experts speculated that 300 restaurants were impacted, unfortunately, it seems that roughly 2,025 outlets were compromised.

“As we have reported over the past several months, unfortunately, some Wendy’s restaurants have been the victim of malicious cyber activity targeting customers’ payment card information. ” said Todd Penegor President and CEO, The Wendy’s Company

The data breach was first spotted in January when suspicious transactions were detected by financial institutions, it is likely that the original compromise occurred in 2015.

Fraudsters operated until May when Wendy’s company confirmed that PoS systems at 300 restaurants were infected with a PoS malware.

Attackers used a malicious code that was able to steal payment card data from PoS systems.

“Wendy’s first reported unusual payment card activity affecting some restaurants in February 2016. In May, we confirmed that we had found evidence of malware being installed on some restaurants’ point-of-sale systems, and had worked with our investigator to disable it.  On June 9th, we reported that we had discovered additional malicious cyber activity involving other restaurants.  That malware has also been disabled in all franchisee restaurants where it has been discovered.” added Penegor.

A particular caught my attention, since Wendy’s has started the investigation the malware used to compromise the PoS systems in the stores evolved, and a new variant was detected by the experts while infecting restaurants of the chain.

“As part of the ongoing investigation that has been underway, Wendy’s discovered a variant of the malware – similar in nature to the original but different in its execution – affecting additional franchise locations.” reads the statement issued by Wendy. “We believe this series of cybersecurity attacks resulted from certain service providers’ remote access credentials being compromised, allowing access to the POS system.”

The company is still investigating with law enforcement and actors in the payment industry contacts. It seems that Wendy’s firm has successfully removed the malware from its systems.

To discover which stores have been hacked, use the service deployed by Wendy’s company.

[adrotate banner=”9″] [adrotate banner=”12″]

Pierluigi Paganini

(Security Affairs – Wendy’s, data breach)

[adrotate banner=”5″]

[adrotate banner=”13″]

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.

Recent Posts

FBI deleted China-linked PlugX malware from over 4,200 US computers

The FBI has removed Chinese PlugX malware from over 4,200 computers in networks across the…

8 hours ago

Russia-linked APT UAC-0063 target Kazakhstan in with HATVIBE malware

Russia-linked threat actor UAC-0063 targets Kazakhstan to gather economic and political intelligence in Central Asia.…

14 hours ago

A new campaign is likely targeting a zero-day in Fortinet FortiGate firewalls<gwmw style="display:none;"></gwmw>

Experts warn of a new campaign targeting an alleged zero-day in Fortinet FortiGate firewalls with…

18 hours ago

Threat actors exploit Aviatrix Controller flaw to deploy backdoors and cryptocurrency miners

A critical vulnerability in Aviatrix Controller is actively exploited to deploy backdoors and cryptocurrency miners…

20 hours ago

U.S. CISA adds BeyondTrust PRA and RS and Qlik Sense flaws to its Known Exploited Vulnerabilities catalog

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds BeyondTrust PRA and RS and Qlik Sense…

1 day ago

Inexperienced actors developed the FunkSec ransomware using AI tools

FunkSec, a new ransomware group that attacked more than 80 victims in December 2024, was…

1 day ago

This website uses cookies.