News

Wendy's announces locations affected by massive cyber-attack

July 8, 2016

Wendy's has provided updated information on exact locations that may have been involved in a credit card breach that was first reported in February, but appears to have started last fall at numerous U.S. locations of the chain. In total, Wendy's spokesman Bob Bertini said about 1,025 locations were affected. 

The first report of problems came this past winter when a breach was discovered. Then in June, Wendy's reported that it had found and disabled a malware variant in its payment system. 

"We are committed to protecting our customers and keeping them informed. We sincerely apologize to anyone who has been inconvenienced as a result of these highly sophisticated, criminal cyberattacks involving some Wendy's restaurants," said Wendy's President and CEO Todd Penegor. "We have conducted a rigorous investigation to understand what has occurred and apply those learnings to further strengthen our data security measures."

Wendy's has set up a special web page with information for customers at www.wendys.com/notice. On that page, within a Q-and-A section, customers are directed to another page — https://payment.wendys.com/paymentcardcheck.html — where they can search for locations affected in their individual cities. The company said that all breaches occurred at U.S. locations. The company is offering customers who may have been affected by the attack a free year of fraud consultation and identity restoration services.

Wendy's is working with forensic experts, federal law enforcement and payment card industry contacts to get to the bottom of the attack, in which the company said specific payment card information, including cardholder names, credit or debit card numbers, expiration dates, cardholder verification values, and service codes were all targeted.

Wendy's said in a press release that the cyberattacks happened when service providers' remote access credentials were compromised, giving the criminals access to some of their franchisees' point-of-sale systems, where they deployed malware.

The attacks started in late fall 2015, according to the release.