US burger chain Five Guys has disclosed a data breach impacting job applicants, and the company may be facing a lawsuit over the cybersecurity incident.
Five Guys appears to have started informing customers on December 29, when it also notified state authorities about the incident.
It’s not uncommon for companies to disclose cybersecurity incidents just before or during major holidays in an effort to avoid too much media coverage. However, Five Guys’ data breach notification was noticed by Turke & Strauss, a law firm specializing in data breaches.
The law firm, which is urging impacted individuals to get in touch to discuss potential legal action against the fast food chain, revealed that exposed information includes names, Social Security numbers, and driver’s license numbers.
The copies of the notification letters that were made public only mention that names and unspecified information that appears to vary from one individual to another have been compromised.
Little information is available about the incident itself. The company said it identified “unauthorized access to files on a file server” on September 17, 2022. An investigation completed on December 8 showed that the exposed files contained information submitted to the company in connection with its employment process.
It’s unclear if the incident was part of a ransomware attack or if someone simply stumbled upon an unprotected cloud storage instance. SecurityWeek has reached out to Five Guys for more information.
Affected individuals are being offered free credit monitoring and identity protection services.
It’s unclear exactly how many people are impacted, but authorities in Massachusetts have been informed about 93 residents of the state being affected, and Montana about 12 impacted individuals.
Five Guys has more than 1,700 locations and employs over 5,000 individuals worldwide.
Related: Canadian Supermarket Chain Sobeys Hit by Ransomware Attack
Related: 7-Eleven Closes Stores in Denmark After Hacker Attack
Related: Retail Giant Woolworths Discloses Data Breach Impacting 2.2 Million MyDeal Customers
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- Intel Boasts Attack Surface Reduction With New 13th Gen Core vPro Platform
- Dole Says Employee Information Compromised in Ransomware Attack
- High-Severity Vulnerabilities Found in WellinTech Industrial Data Historian
- CISA Expands Cybersecurity Committee, Updates Baseline Security Goals
- Exploitation of 55 Zero-Day Vulnerabilities Came to Light in 2022: Mandiant
- Organizations Notified of Remotely Exploitable Vulnerabilities in Aveva HMI, SCADA Products
- Waterfall Security, TXOne Networks Launch New OT Security Appliances
- Hitachi Energy Blames Data Breach on Zero-Day as Ransomware Gang Threatens Firm
Latest News
- US Charges 20-Year-Old Head of Hacker Site BreachForums
- Tesla Hacked Twice at Pwn2Own Exploit Contest
- CISA Ships ‘Untitled Goose Tool’ to Hunt for Microsoft Azure Cloud Infections
- Critical WooCommerce Payments Vulnerability Leads to Site Takeover
- PoC Exploit Published for Just-Patched Veeam Data Backup Solution Flaw
- CISA Gets Proactive With New Pre-Ransomware Alerts
- Watch on Demand: Supply Chain & Third-Party Risk Summit Sessions
- TikTok CEO Grilled by Skeptical Lawmakers on Safety, Content
