5 ms·

"No, Panera Bread Doesn’t Take Security Seriously" I didn't expect this to be an actual description of a security event, but just a rhetorical observation: of

"No, Panera Bread Doesn’t Take Security Seriously" I didn't expect this to be an actual description of a security event, but just a rhetorical observation: of course Panera Bread doesn't take security seriously. There's no "security" in the name of their company. They are not in the security business. I think they do actually take bread seriously. And store location, and customer service, and stuff like that, because that's the kind of business they are. Because of PCI you can expect they probably do handle your credit card (except apparently the last 4) reasonably well. Because of other regulations you can expect they take food safety seriously. They take basic business operations seriously because there's a bunch of professional business-runners, and they know they really have to.

CiPHPerCoder 9y ago
The title is a retort to a statement they made about "we take data security very seriously" while lying about solving the problem.
CobrastanJorji 9y ago
I'm no expert, but PCI requires that companies protect stored cardholder data, which includes cardholder names. They have badly failed to do so, so they don't appear to be PCI compliant.
- SandwichTeeth 9y ago
  This is actually an interesting case from a PCI perspective. PCI doesn't protect last 4 of a credit card number or names individually, as you wouldn't be able to link name to card number if stored separately. Name is only 'cardholder data' when stored with a full cc number. In this case both name and last 4 are stored and revealed together, but I still don't think that constitutes PCI protected information according to their definition of cardholder data. My initial interpretation is that they wouldn't be in breach of PCI from just the information we have publically available about this issue.
manigandham 9y ago
> Because of PCI you can expect they probably do We can't expect that because they didn't. Rules and best practices do not magically get followed because they exist, and in this case they definitely did not take security (of their customer data) seriously at all.
dsacco 9y ago
This might clarify the title for you: https://www.troyhunt.com/we-take-security-seriously-otherwise/ https://www.troyhunt.com/we-take-security-seriously-otherwis... The title is intended to be a play on the most common response companies make when they experience a serious security failure: "We take security very seriously." We should start a blog called We Take Security Seriously that links to these responses, just like Our Incredible Journey[1] for acquisition announcements. __________ 1. https://ourincrediblejourney.tumblr.com/ https://ourincrediblejourney.tumblr.com/
joering2 9y ago
> I think they do actually take bread seriously. No they don't. They admit on record using same additives as Subway mostly a rubber-type chemicals invented by BASF that make bread more elastic, won't go dry this quick and has longer shell-life. Basically when you eat their bread some ingredients are the same of the tires your car was put on! Further good read how horrible quality their food is: https://www.thealternativedaily.com/panera-bread-additives/ https://www.thealternativedaily.com/panera-bread-additives/
- goldenkey 9y ago
  Seems like those chemicals are total reagents...they react and are not left over.
- mthamil 9y ago
  You can't be serious about that link. It is a quack website that claims that wheat and sugar are harmful additives! It also uses the number of ingredients as a good metric of the healthiness of food.
- manigandham 9y ago
  That's not how ingredients work. This is like saying all "chemicals" are bad, when that would also include water.
beager 9y ago
Are you suggesting that security should be regulated like payment cards and food safety? Because I'm on board.
ams6110 9y ago
Exactly right. What do they know about it? They have an expensive firewall, and SSL on their website, they think they are covered. Companies like this would be better off not on the internet at all. It's not like anyone needs to visit the website to know where the nearest Panera Bread is. Google will tell you, if you don't know.
MertsA 9y ago
It would appear that they have a very serious systemic security problem in their organization. Their "Director of Information Security" is obviously very very incompetent, there wasn't any real resolution after many months even though they claimed it was fixed. There's no way that a single person or even just a handful of managers could be solely to blame for this. If this is how they respond to security issues I think it's a fair bet that they're making the same mistakes that e.g. Target and Home Depot did. Who's to say a VPN connection for some lowest bidder third party vendor hasn't already been used to exfiltrate tons of credit card details?

CiPHPerCoder 9y ago

The title is a retort to a statement they made about "we take data security very seriously" while lying about solving the problem.

CobrastanJorji 9y ago

I'm no expert, but PCI requires that companies protect stored cardholder data, which includes cardholder names. They have badly failed to do so, so they don't appear to be PCI compliant.

SandwichTeeth 9y ago
This is actually an interesting case from a PCI perspective. PCI doesn't protect last 4 of a credit card number or names individually, as you wouldn't be able to link name to card number if stored separately. Name is only 'cardholder data' when stored with a full cc number. In this case both name and last 4 are stored and revealed together, but I still don't think that constitutes PCI protected information according to their definition of cardholder data. My initial interpretation is that they wouldn't be in breach of PCI from just the information we have publically available about this issue.

manigandham 9y ago

> Because of PCI you can expect they probably do We can't expect that because they didn't. Rules and best practices do not magically get followed because they exist, and in this case they definitely did not take security (of their customer data) seriously at all.

dsacco 9y ago

This might clarify the title for you: https://www.troyhunt.com/we-take-security-seriously-otherwise/ https://www.troyhunt.com/we-take-security-seriously-otherwis... The title is intended to be a play on the most common response companies make when they experience a serious security failure: "We take security very seriously." We should start a blog called We Take Security Seriously that links to these responses, just like Our Incredible Journey[1] for acquisition announcements. __________ 1. https://ourincrediblejourney.tumblr.com/ https://ourincrediblejourney.tumblr.com/

joering2 9y ago

> I think they do actually take bread seriously. No they don't. They admit on record using same additives as Subway mostly a rubber-type chemicals invented by BASF that make bread more elastic, won't go dry this quick and has longer shell-life. Basically when you eat their bread some ingredients are the same of the tires your car was put on! Further good read how horrible quality their food is: https://www.thealternativedaily.com/panera-bread-additives/ https://www.thealternativedaily.com/panera-bread-additives/

goldenkey 9y ago
Seems like those chemicals are total reagents...they react and are not left over.
mthamil 9y ago
You can't be serious about that link. It is a quack website that claims that wheat and sugar are harmful additives! It also uses the number of ingredients as a good metric of the healthiness of food.
manigandham 9y ago
That's not how ingredients work. This is like saying all "chemicals" are bad, when that would also include water.

beager 9y ago

Are you suggesting that security should be regulated like payment cards and food safety? Because I'm on board.

ams6110 9y ago

Exactly right. What do they know about it? They have an expensive firewall, and SSL on their website, they think they are covered. Companies like this would be better off not on the internet at all. It's not like anyone needs to visit the website to know where the nearest Panera Bread is. Google will tell you, if you don't know.

MertsA 9y ago

It would appear that they have a very serious systemic security problem in their organization. Their "Director of Information Security" is obviously very very incompetent, there wasn't any real resolution after many months even though they claimed it was fixed. There's no way that a single person or even just a handful of managers could be solely to blame for this. If this is how they respond to security issues I think it's a fair bet that they're making the same mistakes that e.g. Target and Home Depot did. Who's to say a VPN connection for some lowest bidder third party vendor hasn't already been used to exfiltrate tons of credit card details?