Panerabread.com Leaks Millions of Customers Records (krebsonsecurity.com) 88
An anonymous reader quotes a report from Krebs on Security: Panerabread.com, the website for the American chain of bakery-cafe fast casual restaurants by the same name, leaked millions of customer records -- including names, email and physical addresses, birthdays and the last four digits of the customer's credit card number -- for at least eight months before it was yanked offline earlier today, KrebsOnSecurity has learned. The data available in plain text from Panera's site appeared to include records for any customer who has signed up for an account to order food online via panerabread.com. The St. Louis-based company, which has more than 2,100 retail locations in the United States and Canada, allows customers to order food online for pickup in stores or for delivery.
Another data point exposed in these records included the customer's Panera loyalty card number, which could potentially be abused by scammers to spend prepaid accounts or to otherwise siphon value from Panera customer loyalty accounts. It is not clear yet exactly how many Panera customer records may have been exposed by the company's leaky Web site, but incremental customer numbers indexed by the site suggest that number may be higher than seven million. It's also unclear whether any Panera customer account passwords may have been impacted. In a written statement, Panera said it had fixed the problem within less than two hours of being notified by KrebsOnSecurity. But Panera did not explain why it appears to have taken the company eight months to fix the issue after initially acknowledging it privately with [security researcher Dylan Houlihan, who originally notified Panera about customer data leaking from its website back on August 2, 2017].
Another data point exposed in these records included the customer's Panera loyalty card number, which could potentially be abused by scammers to spend prepaid accounts or to otherwise siphon value from Panera customer loyalty accounts. It is not clear yet exactly how many Panera customer records may have been exposed by the company's leaky Web site, but incremental customer numbers indexed by the site suggest that number may be higher than seven million. It's also unclear whether any Panera customer account passwords may have been impacted. In a written statement, Panera said it had fixed the problem within less than two hours of being notified by KrebsOnSecurity. But Panera did not explain why it appears to have taken the company eight months to fix the issue after initially acknowledging it privately with [security researcher Dylan Houlihan, who originally notified Panera about customer data leaking from its website back on August 2, 2017].
Pantera (Score:4, Funny)
Walk on home boy!
Re: (Score:2)
Re: (Score:1)
Pantera Bread
A Vulgar Display of Flour
Four by four (Score:2)
I have the last four digits from one company, and the first four digits from another.
What are the odds of guessing the full number?
Re: (Score:1)
100,000,000:1
Then you still need the security code on the back.
which is 100,000,000,000:1
And/or possibly the billing zip code.
which would be 10,000,000,000,000:1
But hey, you're getting there!
Re: (Score:1)
The TFA said the breach included the physical addresses. You have the ZIP code.
Re: (Score:2)
I think it was a rhetorical question. Not that he was seeking the answer to it, but he was trying to make a point with it.
But maybe I'm giving him too much credit.
Re: (Score:1)
I have the last four digits from one company, and the first four digits from another.
The first four digits identify the issuing bank.
What are the odds of guessing the full number?
There are 16 digits, and you know 8, then that leaves 8. But only one in ten has a proper checksum, so there are 10^7 possibilities.
Re: (Score:3)
The first 6 digits are the BIN range which identify the Card Type (first digit) and Issuing Bank (rest of the BIN). Those are not (by themselves) sensitive. The PCI specification states that the first 6 and last 4 digits of a PAN may be in the clear i.e. 5555 43** **** 3232 and that this has a difficulty of being guesses of 10^6 (due to Luhn check).
As long as the middle 6 are not exposed, then first 6/last 4 isn't a 'huge' concern from a card compromise perspective. It is however, a large risk from a social
Re: Four by four (Score:3, Insightful)
Easy, just call up the card owner, tell them you're from the bank and verify with the last four digits. They'll give it to you no problem!
But Panera did not explain (Score:2)
Good grief (Score:2, Interesting)
Does ANYONE know what they're doing with this sh!t?
Because at this point, all I can safely say is this: If it's online, it ain't secure... period. No matter who tells you it is, it ain't.
Re: (Score:2)
They send me coupons for sandwiches. And probably sell my data to marketing firms, most likely for regional spending statistics.
Also with the account I can order online for pick up, and I get a free pastry sometimes (I think once a month?)
Re: Good grief (Score:1)
Paypal is the biggest target with the most bank account and credit card details by far: zero hacks. Hate the company, but they have a secure system.
Re: (Score:1)
While you're at it, say 'Voldemort'.
hah. (Score:3)
There's an entire industry based around exploiting these kinds of holes for financial gain.
panera, underarmour, zillow, trulia, dominos, wayfair etc etc. Track the sales/customer data, you have a very good idea of revenue numbers.
Security researcher though? Bleh.
Re: (Score:2)
Uh OOO! (Score:4, Funny)
They're gonna be toast!
Re: (Score:1)
They're gonna be toast!
Heyooohhh!
It'd be easier (Score:4, Funny)
Re: (Score:2, Funny)
I we just reported the 2 companies that didn't hand over our data.
Blockbuster and Funcoland.
Are you any safer w/o credit card #? (Score:4, Informative)
My first thought was that Panera doesn’t have my credit card number, since I’ve always used NFC payments (Apple Pay) there. But still - with physical address, email address, and birthday, it probably wouldn’t take much for a bad guy to bluff his way into any number of my other accounts and/or steal my mail to get any physically sent verification (like Citi uses).
If it were only a matter of some jerk getting into my Panera account... but that is the least of my worries.
Re:Are you any safer w/o credit card #? (Score:5, Informative)
NFC from the actual, physical card can send the full track 1 data, including 16-digit account number (Apple Pay shares a virtual number). It's a real card number and could still be potentially used online - just can't be cloned to a magstripe card and used, and can't be used online without the 3-digit code off the back.
Re: (Score:2)
NFC from the actual, physical card can send the full track 1 data, including 16-digit account number (Apple Pay shares a virtual number). It's a real card number and could still be potentially used online - just can't be cloned to a magstripe card and used, and can't be used online without the 3-digit code off the back.
NFC does send the track 1 and 2 data, yes. However, there are two different ways to send NFC data. There is NFC EMV and NFC MSR. The former sends a virtual account number and CVC based on the information from the transaction that is included in the payload of the transaction, and cannot be replayed. The latter sends your exact card data, with a different CVC that is only valid for NFC, and can be replayed. Apple Pay uses the EMV format for sending NFC data. It is not replayable. And account numbers a
Re:You're probably in worse shape (Score:5, Insightful)
But since you paid with Apple Pay, they've also got your Apple ID, and maybe even your phone number.
You don’t seem to know how Apple Pay works - neither piece of information is involved. Additionally, the bank holds any financial liability - not the consumer.
Re: (Score:2)
Re: (Score:2)
https://www.merchantmaverick.com/the-complete-guide-to-credit-card-processing-rates-and-fees/#Breakdown_of_All_Credit_Card_Processing_Fees
They are laughing all the way to the bank.
Re: (Score:2)
From your linked article:
Transactional Fees
These fees are assessed every time you run a transaction. They represent the biggest cost of operating a merchant account.
So, how big is the transactional fee? According to the article, 2.10% plus $0.10. IMHO, that's not unreasonable for the convenience. Of course, it's passed on to consumers. All the consumers. Even the ones who pay cash. So, if you're paying cash, you're subsidizing the ones who use credit cards.
And of course, the humongous interest the CC i
Stop giving them personal information doofuses! (Score:5, Insightful)
Oh for crying out loud! Why the heck would anyone give your name, email address, physical addresses, or birthday to Panera bread just to do an online order! These data breaches are bad, but I'm sick and tired of everyone giving away completely unnecessary information! If the cashier says "What's your zip code" you say "no thanks." If the grocery store wants you to give your name and phone number to get a discount card either lie, or don't get the discount. Enough is enough folks! My sympathy has run out.
Re: (Score:2)
Re: (Score:2, Insightful)
If you're ordering delivery, you're going to have a very interesting time getting your order without providing a physical address for it to be delivered to.
Re: (Score:2, Funny)
Re: (Score:3)
Panera delivers? The ones near me don't. I figured this was for a pick-up order.
Re: (Score:2)
Panera delivers. It may not have rolled out yet where you are, but where I am, they started delivery late last year with their own drivers.
Re: (Score:2)
Why the heck would anyone give your name, email address, physical addresses, or birthday to Panera bread
Same account includes loyalty program.
email address: get rewards info, order confirmation
physical address: get delivery, card billing info
birthday: get birthday rewards
Re: (Score:2)
Re: (Score:2)
These data breaches are bad, but I'm sick and tired of everyone giving away completely unnecessary information!
Nobody is asking you to feel sorry for people. That doesn't mean you have to be okay with companies being incompetent at handling consumer data. Yikes dude, sounds like somebody wants to live in the fantasy of a just world, where everything happens because people deserve it, and we never have to care about anything.
Re: (Score:2)
Oh for crying out loud! Why the heck would anyone give your name, email address, physical addresses, or birthday to Panera bread just to do an online order! These data breaches are bad, but I'm sick and tired of everyone giving away completely unnecessary information! If the cashier says "What's your zip code" you say "no thanks." If the grocery store wants you to give your name and phone number to get a discount card either lie, or don't get the discount. Enough is enough folks! My sympathy has run out.
This data is collected by Panera’s loyalty program. They send you free things on your birthday. If you have food delivered, which Panera offers, you must give them a delivery address. So if you always did online order, in store pickup, without using a loyalty card, they do not have (nor did they ask for) that data. They would only have your payment details in that case. Even if they did not ask for that data, however, they could acquire it. You have to provide your zip code for 3D Secure to work
So That's Why They're so Expensive (Score:1)
Always wondered why it cost $9 to get a kid-sized grilled cheese. Now I know it's to pay for cybersecurity lawsuits.
Ick. (Score:2)
This is almost as disgusting as those bland bread rings they have the gall to call 'bagels'.
monetize it if you think it's valuable (Score:4, Interesting)
$1 per name, email, physical address
$2 per phone number
$3 per credit card number
$4 per SSN
And multiply for combinations thereof. You'll see how fast companies move to secure their data.
GDPR (Score:1)
Related, but not to this particular case.
In the EU, the GDPR will take effect in a couple of months and will have a penalty of up to 4% of worldwide turnover for these types of breaches.
I guess some really big companies will be affected by this in the years to come, and it will force a change of focus starting from the top of companies who want to do business in Europe.
Holy crumbs! (Score:1)
I suspect the guy in charge of web development is toast and will find it hard to pick up the crumbs and make new dough in future. At yeast he has his dignity. Right?
Re: (Score:2)
You can't prove that, and I'm not going to rise to the bait.
Online retailers don't have to store this info (Score:2)
Just sign up with one of the tokenizing payment systems, like Apple Pay. The company itself does not have your credit card numbers, because they are in hardware you carry around. Each purchase generates a single-use card number that the vendor does not need to store anywhere after the transaction.
Re: (Score:3)
This is bad (Score:3, Funny)
Somebody could hack into my loyalty account and take the free cookie I am due with three more visits.
Security Hole = Pastry Hole (Score:2)
I am expecting to get a Month Of Bagels out of this.
Hit close to home (Score:4, Funny)
... or close to localhost at least. I always wondered what they did with all the data I send by mistake to 12.7.00.1
NetRange: 12.7.0.0 - 12.7.0.7
CIDR: 12.7.0.0/29
NetName: PANERA-B13-0-0
NetHandle: NET-12-7-0-0-1
Thanks to... (Score:1)
Re: (Score:2)
With Panera Bread, it's probably more like they let an outside vendor put in equipment on their network that wasn't secured properly, and they were probably relying on a separate (incompetent) vendor to insure that their network was secure.
Consequences? (Score:3)
None.
Those of us who care about incidents like this are increasingly painted into a corner. The sheeple, on the other hand, just don't care. If they get a chance to trade their contacts list for 20 "reward points", they'll do it in a heartbeat. If you're on that list, too bad.
And companies like Panerabread continue to get away with this kind of nonsense.
Just once, I would love to see somebody whose family was affected by something like this put the entire lives of the offending corporation's board on-line. Names, addresses, tax returns, where their kids go to school...all of it. See how they like it when they face the same sort of exposure they inflict on others, with maybe a little interest added.
jail time NOW! (Score:2)
Per PCI Compliance, Panera could owe... (Score:2)
Re: (Score:2)
Let me guess... (Score:1)
Let me guess, another diversity hire?
Irresponsible disclosure (Score:2)
Third world programmer==third world code (Score:2)
This is what we get from hiring cheap third world H1B labor. Third world labor, third world code. Best thing we can do is kill the entire H1B program and hire only American geeks to maintain these systems
another reason to avoid Panera (Score:2)
Actual birthdays?? (Score:2)
I always put April 1 as my birthday when companies ask for it for their membership bonus programs. It's easy to remember and after all, the joke's on them. Why would anyone give their real birth date to these kinds of things?
Fun fact about the CIO... (Score:2)