Arby's Loses over 350K Credit Card Numbers

Arby's was infected with malware that siphoned hundreds of thousands of credit card numbers over a period of several weeks. A spokesperson for the Atlanta based company said they were first notified by industry partners in mid-January about a breach at some stores, but that it had not gone public about the incident at the request of the FBI.

“Arby’s Restaurant Group, Inc. (ARG) was recently provided with information that prompted it to launch an investigation of its payment card systems,” the company said in a written statement provided to Brian Krebs with KrebsOnSecurity. The statement continued, “Upon learning of the incident, ARG immediately notified law enforcement and enlisted the expertise of leading security experts, including Mandiant. While the investigation is ongoing, ARG quickly took measures to contain this incident and eradicate the malware from systems at restaurants that were impacted.”

Arby's would not say how long the malware was active or how many credit card numbers were lost, but PSCU, a service organization that services more than 800 credit unions, in a statement said that over 355,000 credit and debit card numbers for credit unions they service were affected. The breach is estimated to have taken place from Oct. 25, 2016 to Jan. 19, 2017.

What Can I Do To Protect Myself: The key thing to remember is that you have many tools at your disposal to protect your finances and credit rating.  

• Monitor your credit and debit card activity to identify any inaccurate charges and report them immediately to the financial institution.

• Visit annualcreditreport.com and obtain a free credit report every 4 months. Each credit service is required to provide one report per year at no charge, so rotate through each service to identify any inaccurate information year around. Report any suspicious activity to the reporting agency right away.

• Be on the lookout for phishing scams. When this news breaks, cybercriminals will use this opportunity to send out 100's of millions of phishing emails pretending to be either Wendy's or your financial institution in an effort to get you to give up your financial account information. The scam is simple, but the emails are very convincing so follow a few email and text rules to avoid being the next victim of identity theft or fraud.