Restaurant Data Breach Probe Filing: Card Data In Plain Text, Default Passwords And Wide Open Wireless Access
Written by Evan SchumanApril 6th, 2011
A Massachusetts restaurant chain, which was just fined $110,000 by that state's attorney general as a result of a substantial data breach, is a textbook example of how not to handle payment security. Court filings from the case paint a classic picture: unchanged default passwords, wide open wireless access, full card data stored in plain text and an impressive lack of concern about the breach, with restaurants continuing to accept payment cards after the chain knew of the breach and malware that had not yet been deactivated.
The breach at the chain, The Briar Group (The Lenox, MJ O'Connor's, Ned Devine's, The Green Briar and The Harp), impacted at least 125,000 MasterCard and Visa customers, the state filing said. Other security naughtiness alleged: using the default usernames and passwords from its Micros POS systems, opting to not change network passwords "for more than five years," allowing those username/password combos to be "used system-wide for all users" and then not changing passwords after employees quit or were fired.
This Story Is Only Available For Premium Subscribers. Click Or Login In Below To Read The Rest Of This Story.
Already a Subscriber? Login Here
Pages: 1 2
Leave a Reply
Readers, specifically those who want to comment on a story:
Our Comment SPAM system is getting very aggressive these days and has been blocking legitimate comments. If you post a comment and don't see it appear within 2 hours or so, can you please send a heads-up to customer-service@storefrontbacktalk.com? Ideally, please include the time you posted the comment. That will allow us to try and hunt for it. Thanks! P.S. We're working on fixing the system, but we don't want to lose any valuable comments in the meantime.
Our Comment SPAM system is getting very aggressive these days and has been blocking legitimate comments. If you post a comment and don't see it appear within 2 hours or so, can you please send a heads-up to customer-service@storefrontbacktalk.com? Ideally, please include the time you posted the comment. That will allow us to try and hunt for it. Thanks! P.S. We're working on fixing the system, but we don't want to lose any valuable comments in the meantime.
I have strong reservations about the 'individual' certification and posting of that information for merchants. Can you imagine the potential employee poaching that might occur? The implications when competitors can look up how many are certified with each of their competitors? 
-Christine
