Noodles and Pizza Serve Up Credit Card Fraud

People who eat out should check their payment card details for potential fraudulent charges. Two popular food chains, Noodles & Company and CiCi’s Pizza are both investigating possible breaches.

In the first case, the company is investigating unusual activity reported in mid-May by its credit card processor. Multiple fraudulent charges were reported at financial institutions on cards that were used at various Noodles & Company restaurants starting in January 2016. As a result of this, law enforcement was alerted and the company started working with third party forensics experts. The investigation is ongoing and it isn’t known yet which locations were affected.

In the case of CiCi’s Pizza, it is still under investigation and a bit more complicated. According to Brian Krebs, there seems to be a link between the point-of-sale (POS) systems used at the stores and Teamviewer, a service that lets users remotely share their desktops with contacts. This is particularly useful for remote technical support. Interestingly, although Teamviewer denies a data breach, the possible incident at CiCi’s is being blamed on a breach at Teamviewer and the fact that someone may have re-used a password that was stolen in the recently announced Tumblr or LinkedIn breaches; which resulted in approximately 230 million passwords and email addresses being leaked.

In addition, it is being reported that someone posing as a technical support representative convinced CiCi’s employees that support was needed for their POS system and using the reused credentials, the hackers may have been successful.

For patrons of these restaurants, be extra diligent in checking payment card charges for fraud for the next year or more. Report anything that is suspect to the issuing institution for resolution.

In addition, if you are given the option to use a debit card as a credit card when you check out of a store, choose credit. This gives you additional protection that using the debit card and PIN does not. For example, if a hacker gets your debit card number and PIN, a copy of that card can be reproduced and used at an ATM to drain your bank account.

The investigation into both of these cases is continuing, but if you have visited these establishments this year, pay closer attention to the charges on your statements.