Back in January we reported that Wendy’s was investigating a possible breach – that was confirmed in June of this year when Wendy’s admitted that they had a breach which was larger than originally thought.
Now we have the list of 1,000+ restaurants which were affected by this breach – all of which are said to be franchised locations – Wendy’s states that no corporate stores have been breached.
There are more than 5,700 Wendy’s locations in the U.S., but it was only franchises and not company-owned restaurants that were impacted.
The malware behind the data breach has since been identified and removed.
Wendy’s released a searchable list of all the affected locations and is urging customers to be alert for unusual purchases on their credit card bills.
The Wendy’s company has stepped up and is offering credit monitoring services to any customer who has used a card any an affected store.
The statement from Wendy’s President and CEO, Todd Penegor:
Dear Valued Customers,
As we have reported over the past several months, unfortunately, some Wendy’s restaurants have been the victim of malicious cyber activity targeting customers’ payment card information. We sincerely apologize to anyone who has been inconvenienced as a result of these highly sophisticated, criminal cyberattacks. We have conducted a rigorous investigation to understand what has happened and we are committed to protecting our customers and keeping you informed.
Wendy’s first reported unusual payment card activity affecting some restaurants in February 2016. In May, we confirmed that we had found evidence of malware being installed on some restaurants’ point-of-sale systems, and had worked with our investigator to disable it. On June 9th, we reported that we had discovered additional malicious cyber activity involving other restaurants. That malware has also been disabled in all franchisee restaurants where it has been discovered. We believe that both criminal cyberattacks resulted from service providers’ remote access credentials being compromised, allowing access – and the ability to deploy malware – to some franchisees’ point-of-sale systems.
We have issued the notification below to provide more information to our customers regarding this incident, our response, and the steps you can take to protect yourself. On behalf of affected franchise locations, we are also providing information about specific restaurant locations that may have been impacted by these attacks, all of which are located in the U.S., along with support for customers who may have been affected by the malware variants.
We recommend that you remain vigilant for incidents of fraud and identity theft by reviewing credit card account statements and monitoring your credit report for unauthorized activity. To assist you, Wendy’s has now arranged to offer one year of complimentary fraud consultation and identity restoration services to all customers who used a payment card at a potentially affected restaurant during the time when the restaurant may have been affected.
If you have any questions or would like more information, you may call a toll-free number, (866) 779-0485, 8:00 am to 5:30 pm CST, Monday through Friday excluding major holidays to receive additional information regarding accessing the fraud consultation and identity restoration services. Any additional information on this incident will continue to be posted here.
In a world where malicious cyberattacks have unfortunately become all too common for merchants, we are committed to doing what is necessary to protect our customers. We will continue to work diligently with our investigative team to apply what we have learned from these incidents and further strengthen our data security measures. Thank you for your continued patience, understanding and support.
Sincerely,
Todd Penegor
President and CEO, The Wendy’s Company
Information on this situation is included in Wendy’s Press Release distributed on July 7, 2016.
Notice of Data Breach