14 ms·
Panerabread.com leaks millions of customer records
- ams6110 9y agoThe standard "we take security very seriously" is starting to ring a bit hollow.
- forgotmypw 9y agoI'm picturing one of the Pythons saying it emphatically while raising their eyebrows and nodding to the side a bit.
- dawnerd 9y agoYeah, it's a straight up lie when they say it after theres a security breach. Panera is basically an example of how not to handle this situation.
- bradleyankrom 9y agothey should try offering thoughts and prayers to those affected.
- CiPHPerCoder 9y agohttps://www.troyhunt.com/we-take-security-seriously-otherwise/ https://www.troyhunt.com/we-take-security-seriously-otherwis...
- rbobby 9y agoNo worries.... thoughts and prayers will soon replace it.
- mitchdoogle 9y agoCompanies that actually take it seriously don't have data breaches.
- ourmandave 9y agoJesus Christmas. Honestly, how many more times can they steal my ID? It's gotten so they have to run a diff to see if there's anything new.
- perl4ever 9y agoWell, at least they didn't leak their customers' HIV statuses, unlike the other security breach I read about yesterday...
- ethanwillis 9y agoWas that the Grindr one? That's a HIPAA violation.. big fines..
- detaro 9y agoHIPAA only applies to health-care providers and related entities, not random other companies.
- nkozyra 9y agoRelated entities includes the broader "clearinghouse" entity, which has been applied to debt collectors. I agree it would be a stretch to make a claim but I'm not 100% sure it would be fruitless.
- emaginniss 9y agoA debt collector would apply since they have been contracted by a HIPAA-covered entity and the data they have likely came from that source. Grindr is completely unrelated to another HIPAA-covered entity and any health data you give them is solely your responsibility... so don't.
- zentiggr 9y agoA fixable oversight, I hope.
- mxpxrocks10 9y agoThread from earlier today: https://news.ycombinator.com/item?id=16737583 https://news.ycombinator.com/item?id=16737583
- dsacco 9y agoSo here's a fun note - as it turns out, the Panera Bread Director of Information Security mentioned in that email exchange worked at Equifax from 2009 to 2013. There's a comment mentioning it on that page, but you can find it just by looking at his LinkedIn: https://www.linkedin.com/in/mike-gustavison-b020426/ https://www.linkedin.com/in/mike-gustavison-b020426/ Time is a flat circle. Everything that has happened before will happen again. Every time it happens, we will hear "Security is our top priority" or "We take security very seriously." EDIT: This just got more interesting. Turns out that despite taking the site down for an hour earlier today, they didn't fix it: https://twitter.com/briankrebs/status/980944555423002630 https://twitter.com/briankrebs/status/980944555423002630 Also, based on the vulnerability still working at this endpoint [1], Krebs revised his estimated number to 37 million records: https://twitter.com/briankrebs/status/980949205974953984 https://twitter.com/briankrebs/status/980949205974953984 ________________________________ 1. https://delivery.panerabread.com/foundation-api/users/6781415 https://delivery.panerabread.com/foundation-api/users/678141...
- portofcall 9y agoDon’t forget, “We’re sorry,” “We’ll do better,” and my personal favorite, “Trust us!” I’d prefer crippling fines.
- awat 9y agoAbsolutely agreed. It feels like corps are developing thier own infosec version of the four dogs defense. 4 DOG DEFENSE My Dog Does Not Bite. My Dog Bites, But It Didn't Bite You. My Dog Bit You. But It Didn't Hurt You. My Dog Bit You And Hurt You, But It Wasn't My Fault http://acronymrequired.com/2011/10/the-four-dog-defense.html http://acronymrequired.com/2011/10/the-four-dog-defense.html
- changoplatanero 9y agoYears ago, I was assigned to clean up an office building that had recently been vacated by a government cybersecurity contractor. While throwing away all the trash that had been left behind I discovered a binder that had at least a hundred pages of print outs from mapquest with the location of the panera bread on each circled in pen.
- delfb 9y agoThat could’ve easily been a really boring office lunch option binder, though. ;)
- changoplatanero 9y agoIt was a hundred panera bread's from all over the East Coast. Something suspicious was going on...
- ribosometronome 9y agoDo you think it could have been some sort of investigation? Like they say, criminals aren't born, they're bread.
- 9y ago
- JohnJamesRambo 9y agoIs there any hope companyies like the Y Combinator backed Request Network can save us from this happening over and over? A summary of their plan is at https://request.network https://request.network. What things would prevent them from implementing this? Seems like a great way to stop losing credit card and identity info in breach after breach.
- danso 9y agoMaybe in the future, but there are plenty of companies that ar around Panera's size that had to get into the online-ordering space before SaaS was as big as it is today. Thankfully, much smaller eateries now can use Yelp or Seamless to deal with account management instead of rolling their own bespoke systems
- danso 9y agoI love that the maintenance page has a button labeled "Order Online" (https://delivery.panerabread.com https://delivery.panerabread.com), which is the page/domain broken in the first place! https://imgur.com/a/4xess https://imgur.com/a/4xess
- tuna-piano 9y agoA- This is infuriating B- How can a company have such a bad response? I think just about every big company has put a huge emphasis on data security. But hey, companies are big and technology is complex, so maybe data leaks still happen. But when they do, how can you treat them with such a lack of care? And how can the director of Security be alerted about this and not fix it? Seems potentially criminally negligent? c- The tweets from Brian Krebs are also infuriating (and hilarious) https://twitter.com/briankrebs https://twitter.com/briankrebs Some highlights: "Per my last tweet, Panera issued a statement to Fox News saying the breach only impacted 10,000 customer accounts. Interesting that they had no numbers for me, and yet had this 10k number all ready to go on the same day this was "discovered," eight months after it was reported." "Hey Panera, despite your statements to the contrary, you still haven't fixed this customer info leak. Would you like to revisit the 10k number you just gave to Fox news? https://delivery.panerabread.com/foundation-api/users/12345" https://delivery.panerabread.com/foundation-api/users/12345" "you know what, let's go for 37M instead of 7M: https://delivery.panerabread.com/foundation-api/users/12345" https://delivery.panerabread.com/foundation-api/users/12345" "At the risk of making my job harder (or possibly, easier?) it's clear I'm going to have to write an entire series of blog posts about how not to handle a data breach from a PR perspective. I'm sputtering over here. Gave @panerabread every courtesy and they treat me like an idiot" "Hey @panerabread : before making half-baked statements to the press to downplay the size of a breach, perhaps you should make sure the problem doesn't extend to all other parts of your business, like http://catering.panerabread.com http://catering.panerabread.com , etc. Only proper response is to deep six entire site"
- josefdlange 9y ago"@panerabread" ... "half-baked statements"... Sometimes life imitates art.
- andimm 9y agoKrebs doesn't have to write his own blog series on how to handle breaches (although I might be interested in his version as well) Troy wrote a nice post about it https://www.troyhunt.com/data-breach-disclosure-101-how-to-succeed-after-youve-failed/ https://www.troyhunt.com/data-breach-disclosure-101-how-to-s...
- kardashev 9y agoAaron Swartz faced 35 years in prison for leaking JSTOR articles. Instead of fines, the Chief Security Officer should be fully responsible and face 35 years in jail if a breach happens. You better believe they'll care about security then. Many companies would also rethink whether they need to track and keep personal information at all.
- 1690v 9y agoThat is a terrible idea. Imagine sentencing programmers to jail for security issues in their code.
- toomuchtodo 9y agoWhy is a software developer an engineer when it fluffs their ego, but not an engineer when regulation and consequences for failures are necessary? Yes, if the security failure is grossly negligent, you should face criminal proceedings. As a C level executive, you are responsible for your chain of command.
- zpr 9y agoBy that extension if a McDonald's drive thru employee accidentally spills hot coffee on a customer, the CEO is responsible and should be charged with assault?
- toomuchtodo 9y agoIs that grossly negligent? No. Is keeping the coffee excessively hot for cost reasons, thereby causing the customer to receive third degree burns on their genitals and winning in court? Yes. https://en.m.wikipedia.org/wiki/Liebeck_v._McDonald%27s_Restaurants https://en.m.wikipedia.org/wiki/Liebeck_v._McDonald%27s_Rest... Your culture is set by your leadership. Make good choices.
- zpr 9y agoI'm familiar with the case, that's why I mentioned it. My point was that although they lost the civil suit, there weren't any criminal proceedings against C-levels. I understand the argument of negligence being as guilty as malicious intent but it creates a sweeping blanket that's hardly fair or enforceable. I agree with your principles in theory but it's just impractical.
- tytytytytytytyt 9y agoMaybe someone could go in to business and provide services that would help companies prevent these things from happening?
- efficacydivis 9y agoSecurity consultants and contractors already exist. But why would Panera, Equifax, et al bother investing in better security when they face no consequences for these incidents? Markets can't solve everything
- tytytytytytytyt 9y ago> Security consultants and contractors already exist. Thanks for that protip.
- nkrisc 9y agoBecause that would cause Panera a lot of money and the alternative (this) will likely cost them very little money. The choice then becomes clear: it's cheaper to tweet out an "oops" apology than to actually prevent it. They don't care that your information got leaked, that doesn't enter into the calculation (unless it costs them money, which it doesn't).
- kevin_thibedeau 9y agoLet me guess. They passed their PCI audits with flying colors.
- robbyt 9y agoAs long as that Nessus scan passed, they're in the clear, right?
- sebcat 9y agoMy (potentially limited) understanding: Certification by an ASV doesn't free you from any responsibilities. You could still violate the DSS even if an ASV clears you.
- dx034 9y agoTo be fair, auditors can only check what they were hired to. PCI audits are better than having none at all but they clearly can't be the only audit.
- maxlybbert 9y agoI’m sure the only reason that only partial credit card numbers were stolen is that PCI makes it very hard for Panera to store complete credit card numbers (with expiration dates and the security code on the back).
- lsaferite 9y ago> PCI makes it very hard for Panera to store complete credit card numbers (with expiration dates and the security code on the back) How about impossible. Storing the CVV number is 100% not allowed. Even storing complete cards numbers is only allowed under very specific conditions. Any deviation opens them up to liability for related fraud.
- CWuestefeld 9y agoEven storing complete cards numbers is only allowed under very specific conditions. We encrypt these at the app, even before putting them into the DB, yada yada. The PCI auditor actually made us restore the DB from backup onto another server and show them the data, to prove that some magical process in the backup program didn't cause them to come un-encrypted. They also wanted us to change all corporate email addresses to random characters, ostensibly to prevent spearfishing (we declined to take this suggestion). My point is that they go to crazy lengths to ensure you're doing this stuff right.
- DrScump 9y agoAnd I was worried about the acrylamide.
- corpMaverick 9y agoI didn't even know about acrylamide. Now I am worried.
- somberi 9y agoCommenting only on the speed of response (or the glacial interpretation of it in Panera's case): For companies operating in European Union, the General Data Protection Regulation (GDPR) (1) mandates that such breaches need to be disclosed under 72 hours. The implementation deadline for GDPR is by end of May 2018 (~7 weeks to go). Underarmor, a US-based sports apparel manufacturer, who operates in EU as well, recently had a breach that affected 150-million users, and went public within 3 days of discovering the breach (2). I believe UnderArmor's case is the norm we can expect going forward. (1)https://en.wikipedia.org/wiki/General_Data_Protection_Regulation https://en.wikipedia.org/wiki/General_Data_Protection_Regula... (2) http://www.bbc.com/news/technology-43592470 http://www.bbc.com/news/technology-43592470
- SeriousM 9y agoIt's not a breach when it's openly accessible. It's a leak and nothing else.
- cheeze 9y agoIf you leave the front door open, your security is still breached when someone breaks in. You're just dumb for leaving the front door open.
- kerng 9y agoNot sure if you are trying to be sarcastic. As soon as someone downloads the dataset its a breach. By design vulnerabilities are always the best.
- kerng 9y agoWow, this story is amazing. Companiy got notified last August of a 0 day (no authentication) to download all customer records, but no action taken for half a year. Then a very bad PR stunt leading to even more exposure - one can't make this stuff up... its April 3rd already, right?? Wondering why they couldn't just really fix the problem? Would be interesting to learn more on how they do engineering? Eg. was it all outsourced and someone else tries to fix it now? This year is going to be good!
- stef25 9y agoThat's not what 0 day means.
- kerng 9y agoIt's exactly a 0 day. They were notified last August of a 0 day in their website and 6 months later 6*31 days (31 for simplicity) later it was is still was not fixed. Here the definition: https://en.m.wikipedia.org/wiki/Zero-day_attack https://en.m.wikipedia.org/wiki/Zero-day_attack
- beart 9y agoI think your original statement was confusing because you put 'no authentication' in parenthesis, implying that to be the definition of 0-day
- justherefortart 9y agoMy natural gas provider can't get my bill to print with me emailing them for over a year. So their old 1990s site, worked fine. Upgrade to new whizbang bullshit and a steady stream of emails still can't get it to simply use a CSS print routine. Outsourcing is glorious!
- username223 9y agoThis is why you should lie as much as you can when dealing with for-profit corporations, especially online. Any information you give them will eventually be available to everyone, because they have no reason to care.
- justherefortart 9y agoWhen you rush shit out the door and don't support your development team, this is sadly a common occurrence.
- hashkb 9y agoTheir bagels are also pathetic and embarrassing.
- fantunes 9y agoThe guys responsible for the information security worked at Equifax before: https://www.linkedin.com/in/mike-gustavison-b020426/ https://www.linkedin.com/in/mike-gustavison-b020426/ Coincidence? Strike two?
- yAnonymous 9y agoCould this be a scheme to sell customer data? I assumed for some time that installing backdoors is a good way to sell customer data you otherwise wouldn't be allowed to share.
- FRex 9y agoEquifax didn't fall victim to a backdoor but to an outdated Apache Struts that no one noticed.
- yAnonymous 9y agoI'm not only talking about this particular case, but in general. "Accidental" backdoors let companies share data they legally couldn't share. Look at Facebook and how their API was surprisingly abused for years until they noticed it.
- mr_overalls 9y agoAnd he joined Equifax after jumping ship from A. G. Edwards in 2008, presumably because the company was accused of fraud in that same year. His first security gig was Senior IT Security Analyst at A. G. Edwards and Sons. His only work experience before that was Supervisor of Branch Installations. This seems unbelievable, but that senior security position was his first IT experience.
- UberBoll 9y ago“The biggest concern is credit card data, a breach occurring on a digital property is devastating to companies.” Mike Gustavison , Director of Info Sec , Panera Bread
- deleted 9y ago[deleted]
- crescentfresh 9y agoGood read outlining the timeline of events from the person who originally reported the leak: https://medium.com/@djhoulihan/no-panera-bread-doesnt-take-security-seriously-bf078027f815 https://medium.com/@djhoulihan/no-panera-bread-doesnt-take-s... I found his initial interaction with their head of IT Security (very first initial response) laughably appalling: Dylan Houlihan <dylan@breakingbits.com> to Mike, Geri Haight - Hello Mike et al, Thank you for making yourselves available. There is a security vulnerability on the delivery.panerabread.com website that exposes sensitive information belonging to every customer who has signed up for an account to order Panera Bread online. This shows the customer's full name, email address, phone number and the last four digits of their saved credit card number. Moreover, the customers are easily enumerable which means an attacker could crawl through all the records. I can provide the specific details of the vulnerability over email once you respond, but if you prefer (for more security), I can also encrypt the information with a PGP key you provide me. Alternatively we can hop on a phone call. Best regards, Dylan Houlihan And their response: Mike Gustavison <Mike.Gustavison@panerabread.com> to dylan Dylan, My team received your emails however it was very suspicious and appeared scam in nature therefore was ignored. If this is a sales tactic I would highly recommend a better approach as demanding a PGP key would not be a good way to start off. As a security professional you should be aware that any organization that has a security practice would never respond to a request like the one you sent. I am willing to discuss whatever vulnerabilities you believe you have found but I will not be duped, demanded for restitution/bounty or listen to a sales pitch. Regards, Mike
- mr_overalls 9y ago"...demanding a PGP key" This kind of incompetence directly endangers the privacy and security of anyone who does business with Panera. And it's reminiscent of the kind of incompetence that characterized the Equifax breach and other recent high-profile hacks. Maybe it's time that a subset of IT workers become professionally licensed and liable, like engineers.
- crescentfresh 9y ago> IT workers become professionally licensed and liable, like engineers Except for software engineers, ironically.
- mvkel 9y agoCases like this are why I think the general public vastly overestimate the capabilities of government surveillance. These same people work at NSA, CIA, etc. Not to insult the intelligence of these fine agency folk; my point is security is only as strong as its weakest link. And whether public or private, people can make some very weak choices.