Panera's failure to disclose a known security breach: Difference between revisions
mNo edit summary |
m used galleries |
||
| (2 intermediate revisions by one other user not shown) | |||
| Line 13: | Line 13: | ||
==Original Contact== | ==Original Contact== | ||
On 02 August 2017, Security Researcher Dylan Houlihan first contacted Panera Bread security director Mike Gustavison of a breach after finding it accidentally through their website, containing customers accounts information that includes full name, home address, email address, food preferences, username, phone number, birthday and last four digits of a debit/credit card in plain text.<ref>{{Cite web |last=Houlihan |first=Dylan |date=3 April 2018 |title=No, Panera Bread Doesn’t Take Security Seriously |url=https://medium.com/@djhoulihan/no-panera-bread-doesnt-take-security-seriously-bf078027f815 |url-status=live |archive-url=https://web.archive.org/web/20180403023125/https://medium.com/@djhoulihan/no-panera-bread-doesnt-take-security-seriously-bf078027f815 |archive-date=3 April 2018 |access-date=29 March 2026 |website=Medium}}</ref><ref>{{Cite web |last=Krebs |first=Brian |date=2 April 2018 |title=Panerabread.com Leaks Millions of Customer Records |url=https://krebsonsecurity.com/2018/04/panerabread-com-leaks-millions-of-customer-records/ |url-status=live |archive-url=https://web.archive.org/web/20180402220110/https://krebsonsecurity.com/2018/04/panerabread-com-leaks-millions-of-customer-records/ |archive-date=2 April 2018 |access-date=29 March 2026 |website=KrebsOnSecurity}}</ref> | On 02 August 2017, Security Researcher Dylan Houlihan first contacted Panera Bread security director Mike Gustavison of a breach after finding it accidentally through their website, containing customers accounts information that includes full name, home address, email address, food preferences, username, phone number, birthday and last four digits of a debit/credit card in plain text.<ref>{{Cite web |last=Houlihan |first=Dylan |date=3 April 2018 |title=No, Panera Bread Doesn’t Take Security Seriously |url=https://medium.com/@djhoulihan/no-panera-bread-doesnt-take-security-seriously-bf078027f815 |url-status=live |archive-url=https://web.archive.org/web/20180403023125/https://medium.com/@djhoulihan/no-panera-bread-doesnt-take-security-seriously-bf078027f815 |archive-date=3 April 2018 |access-date=29 March 2026 |website=Medium}}</ref><ref>{{Cite web |last=Krebs |first=Brian |date=2 April 2018 |title=Panerabread.com Leaks Millions of Customer Records |url=https://krebsonsecurity.com/2018/04/panerabread-com-leaks-millions-of-customer-records/ |url-status=live |archive-url=https://web.archive.org/web/20180402220110/https://krebsonsecurity.com/2018/04/panerabread-com-leaks-millions-of-customer-records/ |archive-date=2 April 2018 |access-date=29 March 2026 |website=KrebsOnSecurity}}</ref> | ||
<gallery> | |||
File:Panera Bread hack on website.png|Hacked Website | |||
File:Panera Bread first email.png|First Response | |||
</gallery> | |||
The next day, the company responded back, perceiving the message as spam and a attempt at a "sales pitch", suggesting a "better approach" due to demanding a PGP key to be "not a good way to start off". Couple hours later, Dylan Houlihan responded by stating he didn't make any attempts at a sales pitch, along with asking to send the vulnerability information via PGP or email. | The next day, the company responded back, perceiving the message as spam and a attempt at a "sales pitch", suggesting a "better approach" due to demanding a PGP key to be "not a good way to start off". Couple hours later, Dylan Houlihan responded by stating he didn't make any attempts at a sales pitch, along with asking to send the vulnerability information via PGP or email. | ||
<gallery> | |||
File:Panera Bread third email.png|PGP Received | |||
File:Panera Bread second email.png|Second Email | |||
File:Panera Bread fourth email.png|Fourth Email | |||
</gallery> | |||
| Line 36: | Line 39: | ||
==Lawsuit== | ==Lawsuit== | ||
{{ | On 04 May 2018, plaintiff Alisha Boykin, Kristen Hansen, Tracy Mangano, Amy Dittbenner, Lara Sulelman, and Dusica Perez file a class action lawsuit against Panera for failure to investigate and alert customers of the data breach, claiming "Panera has taken no other efforts since discovering the security breach to inform customers that their Personal Identifying Information was leaked and/or compromised.”<ref>{{Cite web |last=Shaak |first=Erin |date=6 April 2018 |title=Panera Bread Facing Lawsuit Over Potential Security Breach |url=https://www.classaction.org/blog/panera-bread-facing-lawsuit-over-potential-security-breach |url-status=live |access-date=29 March 2026 |website=ClassAction}}</ref> The case was voluntary dismissed without prejudice by the plaintiffs on June 2018 due to lack of affiliation with the data breach.<ref>{{Cite web |last=Bucher |first=Anne |date=7 June 2018 |title=Panera Data Breach Class Action Voluntarily Dismissed by Plaintiffs |url=https://topclassactions.com/lawsuit-settlements/lawsuit-news/panera-data-breach-class-action-voluntarily-dismissed-plaintiffs/ |url-status=live |access-date=29 March 2026 |website=Top Class Action}}</ref> | ||
==Consumer response== | ==Consumer response== | ||
{{Ph-I-ConR}} | {{Ph-I-ConR}} | ||
| Line 44: | Line 46: | ||
{{reflist}} | {{reflist}} | ||
[[Category:Panera Bread]] | [[Category:Panera Bread]] | ||
[[Category:2017 incidents]] | |||