Chipotle says hackers hit most restaurants in data breach
Chipotle says hackers hit most restaurants in data breach
By Lisa Baertlein Fri May 26, 2017 | 9:03pm EDT
Hackers used malware to steal customer payment data from
most of Chipotle Mexican Grill Inc's (CMG.N) restaurants over a span of three
weeks, the company said on Friday, adding to woes at the chain whose sales had
just started recovering from a string of food safety lapses in 2015.
Chipotle said it did not know how many payment cards or
customers were affected by the breach that struck most of its roughly 2,250
restaurants for varying amounts of time between March 24 and April 18,
spokesman Chris Arnold said via email.
A handful of Canadian restaurants were also hit in the
breach, which the company first disclosed on April 25.
Stolen data included account numbers and internal
verification codes. The malware has since been removed.
The information could be used to drain debit card-linked
bank accounts, make "clone" credit cards, or to buy items on certain
less-secure online sites, said Paul Stephens, director of policy and advocacy
at the non-profit Privacy Rights Clearinghouse.
The breach could once again threatens sales at its
restaurants, which only recently recovered after falling sharply in late 2015
after Chipotle was linked to outbreaks of E. coli, salmonella and norovirus
that sickened hundreds of people.
An investigation into the breach found the malware
searched for data from the magnetic stripe of payment cards.
Arnold said Chipotle could not alert customers directly
as it did not collect their names and mailing addresses at the time of
purchase.
The company posted notifications on the Chipotle and
Pizzeria Locale websites and issued a news release to make customers aware of
the incident.
Linn Freedman, an attorney at Robinson & Cole LLP
specializing in data breach response, said Chipotle was putting the burden on
the consumer to discover possible fraudulent transactions by notifying them
through the websites.
"I don't think you will get to all of the customers
who might have been affected," she said.
Security analysts said Chipotle would likely face a fine
based on the size of the breach and the number of records compromised.
"If your data was stolen through a data breach that
means you were somewhere out of compliance" with payment industry data
security standards, Julie Conroy, research director at Aite Group, a research
and advisory firm.
"In this case, the card companies will fine Chipotle
and also hold them liable for any fraud that results directly from their
breach," said Avivah Litan, a vice president at Gartner Inc specializing
in security and privacy.
Chipotle did not immediately comment on the prospect of a
fine.
Retailer Target Corp in 2017 agreed to pay $18.5 million
to settle claims stemming from a massive data breach in late 2013.
Hotels and restaurants have also been hit. They include
Trump Hotels, InterContinental Hotels Group as well as Wendy's, Arby's and
Landry's restaurants.
Shares in Chipotle Mexican Grill ended marginally lower
at $480.15 on Friday following the announcement.
(Additional reporting by Natalie Grover and Siddharth
Cavale in Bengaluru and Tom Polansek and Nandita Bose in Chicago; Editing by
Grant McCool and Lisa Shumaker)
Comments
Post a Comment