Dairy Queen Confirms Breach at 395 Stores
Summary: Dairy Queen confirmed on October 9 that malware on cash registers at roughly 395 stores, plus one Orange Julius location, stole customer credit and debit card data, nearly six weeks after KrebsOnSecurity first reported bank indications of a breach. The company said it learned of the incident in late August from law enforcement, and that the same unnamed third-party point-of-sale vendor was used at all breached locations, though sources identified the vendor as Panasonic Retail Information Systems.
Bottom line: The Backoff malware typically gets in through Internet-facing remote access tools protected by weak or easy-to-guess credentials, and Dairy Queen told this reporter on August 22 it had no indication of a breach at any of its 4,500+ locations even though its legal team had already been notified by law enforcement. The pattern repeated across Jimmy John's (216 of 1,900+ locations), Signature Systems (100+ other restaurants), and Goodwill (330+ locations, 18 months undetected) - franchise-heavy retail chains sharing a single point-of-sale provider.
Read the original at Krebs on Security ↗
- Topics
- Cybercrime & Law Enforcement
- Related
- Gootloader Malware Disrupted After Infecting 25,000 Computers Cyber Risks · Nov 13, 2026354 dark web vendors and buyers arrested in Operation Tor Nado Cyber Risks · Nov 13, 2026Law Enforcement Disrupts Gootloader, CastleRAT, and StealC Infrastructure Cyber Risks · Nov 13, 2026