Customers of the fast food chain Wendy’s can get additional information about the breach first reported in February. It released a list of over 1,000 affected locations, which are all in the United States and span the country.
After a lengthy investigation, the company stated that it believes the attacks on its restaurants were the result of a service provider’s remote access credentials being compromised. This allowed the attacker to deploy malware to some of the franchisee’s (as opposed to company-owned restaurants) point of sale (POS) systems. The malware was deactivated shortly after it was discovered on the network.
Any customers who used payment cards at Wendy’s between October 2015 and February 2016 should pay especially close attention to those payment card charges for the next year or longer. Any suspicious activity should be reported immediately to the issuing institution for reconciliation.
For organizations, this is a reminder to hold all third party vendors and service providers accountable for keeping their access credentials secured. It is often necessary to give these people access to your networks, but make sure you provide them an easy-to-understand agreement that lays out penalties for not following your security guidelines. Include the requirement to regularly change passwords for all accounts involving your network and not to give them to anyone, no matter how nicely they ask.
Customers who may have been affected can go to the Wendy’s website for additional information on the breach and to find which restaurants were affected.
For banks and credit unions
Share this article with your members
Copy a ready-made summary and link for your newsletter, website or social posts.
