Forest Global Training Partners

Cyber Risks · Krebs on Security

Sale of 4 Million Stolen Cards Tied to Breaches at 4 Restaurant Chains

Summary: On Nov. 23, the carding bazaar Joker's Stash advertised roughly four million freshly stolen debit and credit cards, which financial industry sources and fraud intelligence firm Gemini Advisory tied to breaches at Krystal, Moe's, McAlister's Deli and Schlotzsky's. Focus Brands, which owns Moe's, McAlister's and Schlotzsky's, was breached between April and July 2019 and disclosed on August 23, while Krystal was breached between July and September 2019 and disclosed in late October; Gemini found nearly 50% of the 1,750+ locations belonging to these restaurants were breached, concentrated in Florida, Georgia, South Carolina, North Carolina and Alabama.

Bottom line: Gemini assessed that Joker's Stash held the data back from July until November to avoid oversaturating the dark web market and lowering card prices, meaning stolen records can sit unlisted for months before they surface. With only 36.7 percent of companies worldwide maintaining full PCI compliance per Verizon's 2019 Payment Security Report, the point-of-sale malware behind these restaurant breaches has a wide field of smaller, less-defended merchants to move down to.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related