Connect with us

Hi, what are you looking for?



Payment Card Breach Hits Over 260 Caribou Coffee Stores

Caribou Coffee informed customers this week that more than 260 of its stores in the United States were hit by a data breach that resulted in the exposure of payment card information.

Caribou Coffee informed customers this week that more than 260 of its stores in the United States were hit by a data breach that resulted in the exposure of payment card information.

According to Caribou Coffee, which is headquartered in Minnesota but owned by German conglomerate JAB Holding Company, the breach was detected on November 28 when its cybersecurity systems detected unusual activity.

An analysis conducted by Mandiant, which Caribou Coffee called in to investigate the incident, revealed that the attackers had access to the company’s systems between August 28 and December 3, 2018.

The attackers may have stolen names and payment card information, including card number, expiration date, and card security code. Caribou Coffee pointed out that payments made through Perks or other loyalty accounts are not affected, and neither are orders placed online with Bruegger’s Bagels, Einstein Bros. Bagels, Manhattan Bagel, and Noah’s NY Bagels.

The coffee company says the breach impacts 217 of its stores in Minnesota and 48 stores across Colorado, Florida, Georgia, Iowa, Kansas, Missouri, North Carolina, North Dakota, South Dakota, and Wisconsin.

According to its website, there are over 270 company-owned stores in the United States, which suggests that a vast majority, if not all, Caribou Coffee locations are impacted by the breach.

Caribou Coffee says it’s confident that the breach has been contained. The company says the FBI has also been informed of the incident.

Advertisement. Scroll to continue reading.

“Please be assured that we are closely monitoring our systems, data, and account access as we always do. Additionally, we are making the necessary changes to strengthen our network against any future attacks, and improve our payment systems to protect your information going forward,” Caribou Coffee stated. “We also are in regular communication with the credit card companies and will provide them with the information necessary to notify the banks that may have issued the affected payment cards.”

Related: Half a Million Cards Exposed in Cheddar’s Scratch Kitchen Breach

Related: Chili’s Restaurants Hit by Payment Card Breach

Related: Over 6 Million Users Hit by Breach at Fashion Retailer SHEIN

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join security experts as they discuss ZTNA’s untapped potential to both reduce cyber risk and empower the business.


Join Microsoft and Finite State for a webinar that will introduce a new strategy for securing the software supply chain.


Expert Insights

Related Content


The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.


As it evolves, web3 will contain and increase all the security issues of web2 – and perhaps add a few more.


A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...


Luxury retailer Neiman Marcus Group informed some customers last week that their online accounts had been breached by hackers.


Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.


Satellite TV giant Dish Network confirmed that a recent outage was the result of a cyberattack and admitted that data was stolen.

Artificial Intelligence

The release of OpenAI’s ChatGPT in late 2022 has demonstrated the potential of AI for both good and bad.


A new study by McAfee and the Center for Strategic and International Studies (CSIS) named a staggering figure as the true annual cost of...