Panera's failure to disclose a known security breach

🧽🫧Article Status Notice: This Article needs to be cleaned up

---

This article contains sources and content, but is lacking proper format and needs more development to meet the wiki's Content Guidelines and provide a high quality and consistent experience for readers. Learn more ▼

Issues may include:

• The article is not following the correct outline for its subject (i.e. incident, company, product)
• This article contains references that do not utilize the <ref></ref> tags or Cite web template.
• The article has "WIP" mentioned next to content
• A quote longer than two sentences does not use the Quote template.

How you can help:

• Copy and paste the layout from the aforementioned preload templates (depending on the article's topic)
• Take URLs, convert them for the Cite web template, and insert them into the correct sentence where the source can verify a claim.
• Remove personal notes left by editors either with <!-- [text here] --> in source editor or when the article is close to being fully cleaned up.
• Flesh out the article with relevant information

This notice will be removed once the article is sufficiently developed. Once you believe the article is ready to have its notice removed, please visit the Moderator's noticeboard, or the Discord (join here) and post to the #appeals channel, or mention its status on the article's talk page.

Back in 02 August 2017, security researcher Dylan Houlihan notified Panera Bread of the breach that allowed hackers to access over 37 million customers personal information via its website, however the company wouldn't take any action until 8 month later on 02 April 2018. This would eventually result in a lawsuit 3 days later, however it was eventually dismissed by the plaintiffs on June 2018.

Original Contact

On 02 August 2017, Security Researcher Dylan Houlihan first contacted Panera Bread security director Mike Gustavison of a breach after finding it accidentally through their website, containing customers accounts information that includes full name, home address, email address, food preferences, username, phone number, birthday and last four digits of a debit/credit card in plain text.

• 
  Hacked Website
• 
  First Response

The next day, the company responded back, perceiving the message as spam and a attempt at a "sales pitch", suggesting a "better approach" due to demanding a PGP key to be "not a good way to start off". Couple hours later, Dylan Houlihan responded by stating he didn't make any attempts at a sales pitch, along with asking to send the vulnerability information via PGP or email.

• 
  PGP Received
• 
  Second Email
• 
  Fourth Email

On the same day, the company send the researcher the PGP key, after which he sends the report to Panera Bread and in a follow up reply, ask if the company was successful in decrypting the report, however the company didn't respond. Dylan Houlihan would sent several more responses asking for confirmation of successfully decrypting the PGP key, eventually receiving a response on 09 August confirming the decryption.

Incident

Website Take down notice

8 months later on 02 April 2018, Dylan Houlihan would inform KrebsOnSecurity and Troy Hunt, with Krebs eventually taking on the offer and contacting Panera Bread chief information officers. After contact, Panera Bread website was taken down for about an hour to fix the vulnerability, eventually releasing a statement, stating that the issued has been solved within 2 hours and showcasing their commitment to security.

"Panera takes data security very seriously and this issue is resolved. Following reports of today of a potential problem on our website, we suspended the functionality to repair the issue. Our investigation is continuing, but there is no evidence of payment card information nor a large number of records being access or retrieved."

KrebsonSecurity would respond to this statement soon after on X (formerly Twitter).

"Hey Panera, despite your statements to the contrary, you still haven't fixed this customer info leak. Would you like to revisit the 10k number you just gave to Fox news? https://t.co/AJeiq6Dfd0"

On the same day, KrebsOnSecurity release their report and within 5 minute Panera Bread would release another statement, stating that less than 10,000 were affected by the incidents;

" Our investigation to date indicates that fewer than 10,000 consumers have been potentially affected by this issue, and we are working diligently to finalize our investigation and take the appropriate next steps"

Soon after Panera Bread announcement, it was discovered that the patch wasn't fixed, with KrebsOnSecurity making a post on X (formerly Twitter) refuting the company claims.

KrebsOnSecurity Link Showcase

"Per my last tweet, Panera issued a statement to Fox News saying the breach only impacted 10,000 customer accounts. Interesting that they had no numbers for me, and yet had this 10k number all ready to go on the same day this was "discovered," eight months after it was reported." "10k records, eh @panerabread ? Isn't that what you told Fox News right after my story ran? Fixed the issue, have you? How do you explain this? https://t.co/tWgSNv71TA"

It was later discovered that the vulnerability affected another one of Panera Breads applications.

"Hey @panerabread : before making half-baked statements to the press to downplay the size of a breach, perhaps you should make sure the problem doesn't extend to all other parts of your business, like https://t.co/rSpkwc3y1v, etc. Only proper response is to deep six entire site"

After several more tweets made by KrebsOnSecurity, Panera Bread would close their website down again for a few hours displaying this message.

Website Second Take down notice

Lawsuit

On 04 May 2018, plaintiff Alisha Boykin, Kristen Hansen, Tracy Mangano, Amy Dittbenner, Lara Sulelman, and Dusica Perez file a class action lawsuit against Panera for failure to investigate and alert customers of the data breach, claiming "Panera has taken no other efforts since discovering the security breach to inform customers that their Personal Identifying Information was leaked and/or compromised.” The case was voluntary dismissed without prejudice by the plaintiffs on June 2018 due to lack of affiliation with the data breach.

Consumer response

Summary and key issues of prevailing sentiment from the consumers and commentators that can be documented via articles, emails to support, reviews and forum posts.

---

Add your text below this box. Once this section is complete, delete this box by clicking on it and pressing backspace.