Home » Money

Millions of Customer Records Leaked at Panera Bread

04 April, 2018, 02:15 | Author: Shawna Walton
  • Panera Bread's website leaked customer records for 8 months, report says

Another security researcher notified Panera of the website vulnerability in August 2017, but the restaurant chain didn't address the issue until Monday.

The website's vulnerability reportedly allowed access to customer information -including customer names, email addresses, home addresses, birthdays and the last four digits of credit card numbers.

However, both Houlihan and Krebs noted that the data in question remained searchable and public on Panera's website.

A security researcher says he reached out to Panera eight months ago about the leak, but that the company did nothing until Monday.

Customers that had signed up for an account to order food through the website may have been affected.

To make matters worse, it seems that Panera Bread wasn't too responsive to solve the problem either.

But Houlihan said the flaw "never disappeared". Despite telling the tipster the problem would be addressed, the personal information of customers was still readily available eight months later. That eventually changed as the URLs of Panera now lead to a page that says, "access denied".

'I checked on it every month or so because I was pissed, ' he told Krebs.

KrebsOnSecurity spoke with Panera's chief information officer John Meister yesterday and the company briefly took the website offline. As of this publication, the site is back online but the data referenced above no longer appears to be reachable.

Exactly how many customers were affected isn't known but according to Krebs and data shared by Hold Security, the number of customer records exposed appears to exceed 37 million.

The data leak was discovered previous year by Dylan Houlihan, who on his LinkedIn page describes himself as the managing principal of New York-based Breaking Bits, a "data mining, reverse engineering and security consulting practice".

Panera says there's no evidence any auto information was accessed or stolen.

Recommended:

  • Kevin Pillar sets a steal trap for Dellin Betances

    Kevin Pillar sets a steal trap for Dellin Betances

    He initially remained in the game, but after showing clear discomfort while attempting a throw he was replaced by Brett Gardner . Austin had tied the game an inning earlier, sending a first-pitch offering from Estrada into the second deck in centre field.
    Shah Rukh Khan's fanboy moment with Christopher Nolan. See pic

    Shah Rukh Khan's fanboy moment with Christopher Nolan. See pic

    You are considered to be a traditionalist who continues to support film as an art form, while your movies are quite futuristic. And of us, who work in this profession and see different formats every day, most of the people I talk to fully understand it.
    Swansea City: Carvalhal 'optimistic' after Man Utd loss

    Swansea City: Carvalhal 'optimistic' after Man Utd loss

    Liverpool were unable to hold onto second place as United moved two points ahead of them at Old Trafford. The Spaniard saved United again with two brilliant stops in quick succession from Swansea sub Abraham.
  • Henrik, Daniel Sedin To Retire After 17 Seasons With Canucks: 'It's Time'

    Henrik, Daniel Sedin To Retire After 17 Seasons With Canucks: 'It's Time'

    As for the Canucks' future prospects, the Sedins emphasized that the team would be in great hands moving forward into the future. They were never able to bring a championship to the West Coast, but led Vancouver to within one game of winning the Cup in 2011.

    UFC Notebook: 'Freak injury' forces Ferguson out of UFC 223

    Nurmagomedov questioned Max Holloway's reasoning and he believes that he is only taking this fight for the paycheque. On a plane tonight and with just 6 days notice, Holloway's manager, Brian Butler-Au, says, "Hawaii should be proud".
    Logo for Pakistan-West Indies T20 series unveiled

    Logo for Pakistan-West Indies T20 series unveiled

    The last time global cricket was played at Karachi's National Stadium was in 2009, a Test match between Pakistan and Sri Lanka. No major teams have toured there since the Sri Lanka team was attacked by terrorists in 2009 in Lahore.
  • OnePlus 6 release secrets spun in pink dust

    OnePlus 6 release secrets spun in pink dust

    But the fact that OnePlus is already talking about the handset, whose name is yet to be confirmed , is quite telling. This device's display was tipped to roll with a Qualcomm Snapdragon 845 processor and an Adreno 630 GPU.
    Trump invited Putin to meet in Washington

    Trump invited Putin to meet in Washington

    Tensions also continue with the U.S. investigation into alleged meddling by Russian Federation in the 2016 presidential election. As we reported earlier, Donald Trump first met with Russia's President on July 7 a year ago , within the G20 summit in Hamburg.
    Russia Shuts American Consulate, Ousts 60 US Diplomats

    Russia Shuts American Consulate, Ousts 60 US Diplomats

    In general, the numbers announced for each nation are identical to the number of Russians they expelled earlier in the week. It also announced the closure of the U.S. consulate in St Petersburg.
  • Countdown to China's space station's fiery return to Earth

    Countdown to China's space station's fiery return to Earth

    Mr McDowell has also pointed out that if part of the space station lands in your garden "it's not yours, it's still China's". The predictions for when Chinese space station Tiangong-1 will come crashing back to Earth are becoming more and more exact.
    Gary Neville Believes Antonio Conte Won't Be At Chelsea Next Season

    Gary Neville Believes Antonio Conte Won't Be At Chelsea Next Season

    We are working very hard to try to have a good season, but I think that, in the end, we are deserving of this season. Former refs chief Keith Hackett says Tottenham should have had two players dismissed for their win over Chelsea .
    Anthony Joshua v Joseph Parker: Heavyweights trim down for unification bout

    Anthony Joshua v Joseph Parker: Heavyweights trim down for unification bout

    We don't know if Joshua, for all his physical advantages, will be able to put enough punches together to send Joe to the canvas. It's easy to say that from the outside, but when you're in there, Anthony Joshua is an absolute monster of a man.


Popular

Donte DiVincenzo's monster block became the best photo from Villanova's title win
It started with 18 points in the first half, many of which came after the sluggish start that left the Wildcats trailing 21-14. No. 3 MI tried to fight back, but DiVencenzo kept hitting shot-after-shot to keep the Wildcats on top.

More murders committed in London than NY
For the "first time in modern history", London had more murders in February than New York City did, according to The Times. Four teenage boys - two aged 16 and two aged 15 - have been charged with GBH after appearing at Stratford Youth Court.

Legalizing medical marijuana could help curb the opioid epidemic
Two new studies released on Monday, April 2, 2018 suggest that legalization of marijuana may reduce the prescribing of opioids . A 2016 law mandates that doctors check the database before prescribing opioids, to make sure patients aren't doubling up.

Trump attacks DACA, US immigration policy again; calls for using 'nuclear option'
President Trump suggested Tuesday he might try to put USA troops on the Mexican border until his anti-migration wall is built. He also said he had spoken with Secretary of Defense James Mattis about the use of the military to guard the border.

Child abuse prevention at forefront of Child Haven event
Each pinwheel represented a child who has been abused and served by Child Haven and/or the Solano Courage Center in 2017. Mead noted that April is Child Abuse Prevention Month, and said prevention can change a child's life.

Falcon 9 rocket lifts off on SpaceX's 14th station cargo mission
After the spacecraft has been captured, NASA TV will resume live coverage of its installation in the Harmony module at 8:30 a.m. The rocket for this mission launched supplies to the International Space Station Aug. 14 and will not be recovered this time.

Dictator Kim Jong-un goes pop as Korean tensions thaw
The event marked the first time a North Korean leader had ever attended a performance by entertainers from the South. However, last Sunday , Kim Jong Un was clapping along and posing for pictures with the music group.

The "Condom Snorting Challenge" Is Even Worse Than It Sounds
The years-old risky dare has resurfaced in recent days as the latest perverse, potentially life-threatening internet challenge . They discovered that an oral-sex mishap caused her to inhale a condom into her lung, which led to its partial collapse.

EPA expected to roll back gas-mileage standards
Hart said he had no contact with Pruitt for many months, other than a brief exchange at the National Prayer Breakfast in February. That trip is the subject of an investigation by the EPA's inspector general, based on requests from Senate Democrats.

Turkey won't negotiate with terrorists in Syria - presidential spokesperson
Such speculation was fueled by President Donald Trump somewhat surprisingly declaring on Thursday that American forces will be "coming out of Syria like very soon".