Become a fan of Slashdot on Facebook

 



Forgot your password?
typodupeerror
Privacy Security Software The Internet

Panerabread.com Leaks Millions of Customers Records (krebsonsecurity.com) 88

An anonymous reader quotes a report from Krebs on Security: Panerabread.com, the website for the American chain of bakery-cafe fast casual restaurants by the same name, leaked millions of customer records -- including names, email and physical addresses, birthdays and the last four digits of the customer's credit card number -- for at least eight months before it was yanked offline earlier today, KrebsOnSecurity has learned. The data available in plain text from Panera's site appeared to include records for any customer who has signed up for an account to order food online via panerabread.com. The St. Louis-based company, which has more than 2,100 retail locations in the United States and Canada, allows customers to order food online for pickup in stores or for delivery.

Another data point exposed in these records included the customer's Panera loyalty card number, which could potentially be abused by scammers to spend prepaid accounts or to otherwise siphon value from Panera customer loyalty accounts. It is not clear yet exactly how many Panera customer records may have been exposed by the company's leaky Web site, but incremental customer numbers indexed by the site suggest that number may be higher than seven million. It's also unclear whether any Panera customer account passwords may have been impacted. In a written statement, Panera said it had fixed the problem within less than two hours of being notified by KrebsOnSecurity. But Panera did not explain why it appears to have taken the company eight months to fix the issue after initially acknowledging it privately with [security researcher Dylan Houlihan, who originally notified Panera about customer data leaking from its website back on August 2, 2017].

This discussion has been archived. No new comments can be posted.

Panerabread.com Leaks Millions of Customers Records

Comments Filter:
  • Pantera (Score:4, Funny)

    by fattmatt ( 1042156 ) on Monday April 02, 2018 @09:35PM (#56370361)

    Walk on home boy!

  • I have the last four digits from one company, and the first four digits from another.
    What are the odds of guessing the full number?

    • by Anonymous Coward

      100,000,000:1

      Then you still need the security code on the back.
      which is 100,000,000,000:1

      And/or possibly the billing zip code.
      which would be 10,000,000,000,000:1

      But hey, you're getting there!

      • by Anonymous Coward

        The TFA said the breach included the physical addresses. You have the ZIP code.

    • I have the last four digits from one company, and the first four digits from another.

      The first four digits identify the issuing bank.

      What are the odds of guessing the full number?

      There are 16 digits, and you know 8, then that leaves 8. But only one in ten has a proper checksum, so there are 10^7 possibilities.

    • Re: Four by four (Score:3, Insightful)

      by Anonymous Coward

      Easy, just call up the card owner, tell them you're from the bank and verify with the last four digits. They'll give it to you no problem!

  • 'cause nobody made them. your data is your problem. not ours.
  • Good grief (Score:2, Interesting)

    by Anonymous Coward

    Does ANYONE know what they're doing with this sh!t?

    Because at this point, all I can safely say is this: If it's online, it ain't secure... period. No matter who tells you it is, it ain't.

    • They send me coupons for sandwiches. And probably sell my data to marketing firms, most likely for regional spending statistics.

      Also with the account I can order online for pick up, and I get a free pastry sometimes (I think once a month?)

    • by Anonymous Coward

      Paypal is the biggest target with the most bank account and credit card details by far: zero hacks. Hate the company, but they have a secure system.

      • by Anonymous Coward

        While you're at it, say 'Voldemort'.

  • by rogoshen1 ( 2922505 ) on Monday April 02, 2018 @09:38PM (#56370373)

    There's an entire industry based around exploiting these kinds of holes for financial gain.

    panera, underarmour, zillow, trulia, dominos, wayfair etc etc. Track the sales/customer data, you have a very good idea of revenue numbers.

    Security researcher though? Bleh.

    • The fate of Panera as a company and/or insider trading should be the least of the worries. Just another big chain. I'm more worried about the customers who were compromised,
  • Uh OOO! (Score:4, Funny)

    by EETech1 ( 1179269 ) on Monday April 02, 2018 @09:42PM (#56370381)

    They're gonna be toast!

  • by Ol Olsoc ( 1175323 ) on Monday April 02, 2018 @09:49PM (#56370439)
    I we just reported the 2 companies that didn't hand over our data.
  • by 93 Escort Wagon ( 326346 ) on Monday April 02, 2018 @09:53PM (#56370459)

    My first thought was that Panera doesn’t have my credit card number, since I’ve always used NFC payments (Apple Pay) there. But still - with physical address, email address, and birthday, it probably wouldn’t take much for a bad guy to bluff his way into any number of my other accounts and/or steal my mail to get any physically sent verification (like Citi uses).

    If it were only a matter of some jerk getting into my Panera account... but that is the least of my worries.

    • by omnichad ( 1198475 ) on Monday April 02, 2018 @10:59PM (#56370679) Homepage

      NFC from the actual, physical card can send the full track 1 data, including 16-digit account number (Apple Pay shares a virtual number). It's a real card number and could still be potentially used online - just can't be cloned to a magstripe card and used, and can't be used online without the 3-digit code off the back.

      • NFC from the actual, physical card can send the full track 1 data, including 16-digit account number (Apple Pay shares a virtual number). It's a real card number and could still be potentially used online - just can't be cloned to a magstripe card and used, and can't be used online without the 3-digit code off the back.

        NFC does send the track 1 and 2 data, yes. However, there are two different ways to send NFC data. There is NFC EMV and NFC MSR. The former sends a virtual account number and CVC based on the information from the transaction that is included in the payload of the transaction, and cannot be replayed. The latter sends your exact card data, with a different CVC that is only valid for NFC, and can be replayed. Apple Pay uses the EMV format for sending NFC data. It is not replayable. And account numbers a

  • by MobyDisk ( 75490 ) on Monday April 02, 2018 @10:17PM (#56370541) Homepage

    Oh for crying out loud! Why the heck would anyone give your name, email address, physical addresses, or birthday to Panera bread just to do an online order! These data breaches are bad, but I'm sick and tired of everyone giving away completely unnecessary information! If the cashier says "What's your zip code" you say "no thanks." If the grocery store wants you to give your name and phone number to get a discount card either lie, or don't get the discount. Enough is enough folks! My sympathy has run out.

    • Because it's easy and doable without human interaction, likely via the Web or through an "App". And not everyone has a local bodega they can call (as in call, on the phone) and have yummy food ready in 5 minutes.
    • Re: (Score:2, Insightful)

      If you're ordering delivery, you're going to have a very interesting time getting your order without providing a physical address for it to be delivered to.

      • Re: (Score:2, Funny)

        Leave food behind shrub to the left of the park bench. Place chalk mark on mailbox after you've made the drop. You're right, that is interesting.
      • by MobyDisk ( 75490 )

        Panera delivers? The ones near me don't. I figured this was for a pick-up order.

        • Panera delivers. It may not have rolled out yet where you are, but where I am, they started delivery late last year with their own drivers.

    • Why the heck would anyone give your name, email address, physical addresses, or birthday to Panera bread

      Same account includes loyalty program.

      email address: get rewards info, order confirmation
      physical address: get delivery, card billing info
      birthday: get birthday rewards

    • by houghi ( 78078 )

      One does not exclude the other. I should be able to give a company my details without them being given to somebody else. Be it by hacking or selling.
      OTOH they should not be allowed to ask and store information they do not need.

      The laws should show that sentiment. You know, like laws for the people, by the people.
      If 6 peoples details are leaked, they are idiots. If 60 peoples details are leaked, there is a need to see what is going on. If 6.000.000 people are leaked, you can only call them victims. It means

    • by SirSlud ( 67381 )

      These data breaches are bad, but I'm sick and tired of everyone giving away completely unnecessary information!

      Nobody is asking you to feel sorry for people. That doesn't mean you have to be okay with companies being incompetent at handling consumer data. Yikes dude, sounds like somebody wants to live in the fantasy of a just world, where everything happens because people deserve it, and we never have to care about anything.

    • Oh for crying out loud! Why the heck would anyone give your name, email address, physical addresses, or birthday to Panera bread just to do an online order! These data breaches are bad, but I'm sick and tired of everyone giving away completely unnecessary information! If the cashier says "What's your zip code" you say "no thanks." If the grocery store wants you to give your name and phone number to get a discount card either lie, or don't get the discount. Enough is enough folks! My sympathy has run out.

      This data is collected by Panera’s loyalty program. They send you free things on your birthday. If you have food delivered, which Panera offers, you must give them a delivery address. So if you always did online order, in store pickup, without using a loyalty card, they do not have (nor did they ask for) that data. They would only have your payment details in that case. Even if they did not ask for that data, however, they could acquire it. You have to provide your zip code for 3D Secure to work

  • by Anonymous Coward

    Always wondered why it cost $9 to get a kid-sized grilled cheese. Now I know it's to pay for cybersecurity lawsuits.

  • This is almost as disgusting as those bland bread rings they have the gall to call 'bagels'.

  • by supernova87a ( 532540 ) <kepler1@@@hotmail...com> on Monday April 02, 2018 @11:13PM (#56370733)
    I keep saying, the following penalty scheme will clean up data breaches right quick:

    $1 per name, email, physical address
    $2 per phone number
    $3 per credit card number
    $4 per SSN

    And multiply for combinations thereof. You'll see how fast companies move to secure their data.
    • Related, but not to this particular case.

      In the EU, the GDPR will take effect in a couple of months and will have a penalty of up to 4% of worldwide turnover for these types of breaches.

      I guess some really big companies will be affected by this in the years to come, and it will force a change of focus starting from the top of companies who want to do business in Europe.

  • by Anonymous Coward

    I suspect the guy in charge of web development is toast and will find it hard to pick up the crumbs and make new dough in future. At yeast he has his dignity. Right?

  • Just sign up with one of the tokenizing payment systems, like Apple Pay. The company itself does not have your credit card numbers, because they are in hardware you carry around. Each purchase generates a single-use card number that the vendor does not need to store anywhere after the transaction.

    • Or just pay good, old-fashioned, cold, hard cash to a vendor that's not a large corporation. Call a restaurant for delivery or just pick up yourself.
  • This is bad (Score:3, Funny)

    by wyattstorch516 ( 2624273 ) on Tuesday April 03, 2018 @12:01AM (#56370869)

    Somebody could hack into my loyalty account and take the free cookie I am due with three more visits.

  • I am expecting to get a Month Of Bagels out of this.

  • by ace123 ( 758107 ) on Tuesday April 03, 2018 @01:41AM (#56371105) Homepage

    ... or close to localhost at least. I always wondered what they did with all the data I send by mistake to 12.7.00.1

    NetRange: 12.7.0.0 - 12.7.0.7
    CIDR: 12.7.0.0/29
    NetName: PANERA-B13-0-0
    NetHandle: NET-12-7-0-0-1

  • Thanks to Carbs on Security for keeping us posted
  • by hyades1 ( 1149581 ) <hyades1@hotmail.com> on Tuesday April 03, 2018 @04:21AM (#56371421)

    None.

    Those of us who care about incidents like this are increasingly painted into a corner. The sheeple, on the other hand, just don't care. If they get a chance to trade their contacts list for 20 "reward points", they'll do it in a heartbeat. If you're on that list, too bad.

    And companies like Panerabread continue to get away with this kind of nonsense.

    Just once, I would love to see somebody whose family was affected by something like this put the entire lives of the offending corporation's board on-line. Names, addresses, tax returns, where their kids go to school...all of it. See how they like it when they face the same sort of exposure they inflict on others, with maybe a little interest added.

  • Who's going to fucking jail for this? Who's going to fucking jail!!!
  • So, the card companies can asses a fine of up to $100,000 per month per violation. Per TFA, the number affected "exceed 37 million", and they knew about this for 8 months. Therefor, Panera / the processing bank/ "someone" should be hit with a $29,600,000,000,000. Well, the "whole PAN" wasn't exposed, only the last 4 out of 16. So, to be fair, the fine should be $7,400,000,000,000. I'm sure they have proper "errors and omissions insurance" to cover about 10% of GWP (global world production). I mean, that's
  • As long as there is no accountability, meaning somebody high up gets at least fired and a serious fine is imposed, nothing will change.

    What is the real reason companies would do anything about it? Because it is a bit bad press and that will cost them a bit of customers. As a company I would say "Fuck it, save the data on every local PC in plain text. Much cheaper. We will deal with it when it happens"
    Then when it happens, you just say 'Oops' and do it then.

    Now if the fine where dependent on both the worth o

  • Let me guess, another diversity hire?

  • Looking at the history of the report and Panera's response, it just reinforces my belief that "responsible disclosure" just serves to protect the company/vendor from liability and provides no incentive to change behavior. Immediate full disclosure would introduce some incentives to actually change behavior. Although a reasonable compromise might be cutting the time to disclosure down enough, this guy gave them eight months. Two weeks would be better.
  • This is what we get from hiring cheap third world H1B labor. Third world labor, third world code. Best thing we can do is kill the entire H1B program and hire only American geeks to maintain these systems

  • Panera has been on my do-not-buy-there list for some time. My favorite bagel is the jalapeno-cheese variety. The local Panera only made them occasionally. The last time I asked when they would be making them again, the snooty dipstick behind the counter said they were no longer making them. When I asked why, she said something about fat content or some related drivel. When I explained I exercise a lot and I'll eat anything I please and would you make them again, she said no way. I said you'll get no m
  • I always put April 1 as my birthday when companies ask for it for their membership bonus programs. It's easy to remember and after all, the joke's on them. Why would anyone give their real birth date to these kinds of things?

  • He was Chief Security Officer at Equifax until 2013.

Adding features does not necessarily increase functionality -- it just makes the manuals thicker.

Working...