Chipotle Says Hackers Hit Most Restaurants in Data Breach

Hackers used malware to steal customer payment data from most of Chipotle Mexican Grill Inc’s restaurants over a span of three weeks, the company said on Friday, adding to woes at the chain whose sales had just started recovering from a string of food safety lapses in 2015.

Chipotle said it did not know how many payment cards or customers were affected by the breach that struck most of its roughly 2,250 restaurants for varying amounts of time between March 24 and April 18, spokesman Chris Arnold said via email.Chipotle Says Hackers Hit Most Restaurants in Data Breach

A handful of Canadian restaurants were also hit in the breach, which the company first disclosed on April 25.

Stolen data included account numbers and internal verification codes. The malware has since been removed.

The information could be used to drain debit card-linked bank accounts, make “clone” credit cards, or to buy items on certain less-secure online sites, said Paul Stephens, director of policy and advocacy at the non-profit Privacy Rights Clearinghouse.

The breach could once again threatens sales at its restaurants, which only recently recovered after falling sharply in late 2015 after Chipotle was linked to outbreaks of E. coli, salmonella and norovirus that sickened hundreds of people.

An investigation into the breach found the malware searched for data from the magnetic stripe of payment cards.

Arnold said Chipotle could not alert customers directly as it did not collect their names and mailing addresses at the time of purchase.

The company posted notifications on the Chipotle and Pizzeria Locale websites and issued a news release to make customers aware of the incident.

Linn Freedman, an attorney at Robinson & Cole LLP specializing in data breach response, said Chipotle was putting the burden on the consumer to discover possible fraudulent transactions by notifying them through the websites.

“I don’t think you will get to all of the customers who might have been affected,” she said.

Security analysts said Chipotle would likely face a fine based on the size of the breach and the number of records compromised.

“If your data was stolen through a data breach that means you were somewhere out of compliance” with payment industry data security standards, Julie Conroy, research director at Aite Group, a research and advisory firm.

“In this case, the card companies will fine Chipotle and also hold them liable for any fraud that results directly from their breach,” said Avivah Litan, a vice president at Gartner Inc specialising in security and privacy.

Chipotle did not immediately comment on the prospect of a fine.

Retailer Target Corp in 2017 agreed to pay $18.5 million to settle claims stemming from a massive data breach in late 2013.

Hotels and restaurants have also been hit. They include Trump Hotels, InterContinental Hotels Group as well as Wendy’s, Arby’s and Landry’s restaurants

OneLogin Password Manager Reports Data Breach, Potential Decryption of Customer Data

It’s getting harder to avoid the fact that your personal data on the Internet is just not safe any more. Following the recent rise in data breaches that have already hit companies like Yahoo, Dropbox, and Telegram, it now seems OneLogin is the latest to join the list as the company reported Wednesday an “unauthorised access to OneLogin data in our US data region.”OneLogin Password Manager Reports Data Breach, Potential Decryption of Customer Data

OneLogin is a password manager and single sign-on provider, which reported a data breach but has been unclear as to the nature of the attack. The firm’s chief security officer Alvaro Hoyos said in a blog post that “a malicious actor had obtained access to our US operating region.” The company reportedly found a threat actor had “obtained access to a set of Amazon Web Services (AWS) keys and used them to access the AWS API from an intermediate host with another, smaller service provider in the US.”

The severity of the breach to consumers is not yet known but the company has stated that the hack allowed the threat actor to access database tables that contain personal information about users, apps, and various types of keys. While the company maintains that it encrypts certain sensitive data, it didn’t rule out the possibility that the ‘malicious actor’ had the ability to decrypt them.

OneLogin updated the blog post saying that the staff was alerted about the attack at 9am PST (about seven hours after the attack started) and was “able to shut down the affected instance as well as the AWS keys that were used to create it.” Although the firm mentioned that it encrypts sensitive information, many were curious about how the attacker was able to then get access to data that could be decrypted.