P.F. Chang’s Breach Likely Began in Sept. 2013

http://krebsonsecurity.com/2014/06/p-f-changs-breach-likely-began-in-sept-2013/

by wglb • 12 years ago

32 28 12 years ago

krebsonsecurity.com

Alupis4• 12 years ago

Dang nabbit! I love eating here.

sscalia• 12 years ago

You enjoy eating at PF Changs China Bistro? Really?

Do you also enjoy The Olive Garden?

Alupis4• 12 years ago

No.

recursive• 12 years ago

Don't act so surprised. Plenty of people do. They stay in business from the money they get from people who want to eat there.

PhasmaFelis• 12 years ago

What kind of terrible person would like something you don't like, amirite?

pessimizer• 12 years ago

Upvoted for mall food snobbery. The rest of you cretins can get back to the Macaroni Grill where you belong.

pasbesoin3• 12 years ago

People need to to re-evaluate their personal security and convenience protocols.

I consciously consider whether to use a credit card in some venues, because I'm aware that many businesses have significant security lapses and often simply no understanding of the problems, much less motivation to tackle them.

In most situations, you can still pay in cash.

As a side-benefit, with cash you aren't directly giving the "vampire squid" of Big Finance its 3 or 5 or whatever percent... "tithe", I guess I would call it, these days.

(And as for debit cards... unless you are forced to use one, as an end-user why would you forgo the additional protections a credit card offers and take on the risk of a direct route to your personal assets?)

I suggest keeping a few $20's in your wallet and paying for things such as Chang's in cash. I'd rather lose $100 in cash, than deal with a breach of my account security.

I recognize that my thinking at this point doesn't encompass what happens to risk if and when we all start carrying more cash around, again, and become as a group sweeter targets for random robbery.

I also don't haul out an obviously loaded wallet or money clip, when paying. No point in "waving" that cash about and thus standing out of the crowd.

Domenic_S• 12 years ago

You say to use a credit card over a debit card for the added security, but then advocate paying cash instead of relying on that security. Why?

I've had my Amex number stolen once or twice and it was fantastically easy to straighten out. Amex noticed it and called me. They next-day'd a new card, and provided me with a list of places I autopay so I could change my CC#.

The whole ordeal cost me maybe 20 minutes of my time -- well worth the benefit of not fretting over account security.

Alupis4• 12 years ago

Reminds me of the people who get $100 bills from the bank, and like to whip them out like it's a lot of money. As soon as they spend it... it's now in $20's and $10's... seems pointless.

I do like the idea of carrying some cash around -- far too often I've been at a bar with friends and the venue refuses to split the tab, and somehow I always get stuck fronting for everyone.

But... as with most things... it's not convenient to get cash from an ATM all the time, and I always end up not having cash on me when I need it most.

synapticfire• 12 years ago

Rarely are the prices different if paying in cash vs credit (due to agreements I believe) which means you still pay the extra 3 to 5 percent, but receive no reward points, cash back, or anything extra. So in affect, by paying cash, you are receiving less for your money.

mindslight4• 12 years ago

I agree, but don't understand why one would consider credit cards risky. I'd be willing to paint my credit card number on the side of a building for $2000 (and I'm overestimating here, since who knows what chaotic billionaire will read this). There's simply nothing secret about them - they are mere identifiers not authenticators. Public key crypto has been around for nearly 40 years and ubiquitous online transactions for nearly 20 - Visa and Mastercard simply don't care to change as they just push the costs onto merchants, and the costs are still low enough that merchants don't push back.

Paying cash in general is a good idea for privacy's sake (do you really want your auto insurance company becoming aware of how much alcohol you purchase?), and avoiding the 4% tithe is nice. But more importantly, paying tips with cash helps waiters avoid the much more burdensome and directly destructive >30% tithe.

Osiris• 12 years ago

Credit cards have great fraud protection. My accounts even offer a "Dispute this charge" button right in the activity list. If someone steals my number, then I dispute the charge and ask them to mail me a new card.

It's also why I rarely use a debit card. Your at the mercy of your bank if you get PIN scalped and they take money from an ATM. That happened to me once but luckily we got the money back from the credit union (hate banks).

coldcode• 12 years ago

Has anyone yet described exactly how the breach was accomplished? Or as usual no details come out?

vcherubini• 12 years ago

I want to know an explanation of why credit card data was stored. Is this standard? Shouldn't they only need it long enough to process the transaction - there's no reason to store it, correct?

Was the data stolen in transit (should be entirely encrypted) or stolen while at rest?

dmix• 12 years ago

During the Target breach card data was scraped directly from memory of the POS machines via malware. It wasn't being stored anywhere.

nandhp• 12 years ago

Is there any evidence the transaction was stored, except insofar as storage was necessary to carry out the heist? The credit card data could have been intercepted while being input (e.g. by a keylogger).

ryguytilidie• 12 years ago

One of the things that bothers me most about all these breaches is that I can't think of a single reason for many of these companies to store the data, yet they do it, presumably to make some sort of additional profit. Then, when they lose/have that data stolen, its just an "oops! we're doing our best to fix it". Maybe some of these companies can just stop collecting/storing this data if they can't do it securely?

P.F. Chang’s Breach Likely Began in Sept. 2013

Related Stories