US fast food restaurant chain Wendy’s announced recently that it has reached a settlement with the thousands of financial institutions impacted by the data breach suffered by the company in 2015 and 2016.
Wendy’s discovered the breach in January 2016 after the payment industry noticed fraud patterns on some cards used at its restaurants. While initially it appeared that roughly 300 locations had been affected, the investigation launched by the company later revealed that the number of impacted restaurants actually exceeded 1,000.
The hacker attack, aimed at independently owned and operated franchise restaurants, involved a piece of malware designed to steal payment card information, including names, card numbers, expiration dates, and CVVs.
Wendy’s was sued by both customers and financial institutions. The company reached a $3.4 million settlement with customers last year, with each impacted individual being eligible for up to $5,000 in compensation.
Wendy’s last week announced that it also reached a settlement with the banks and credit unions whose payment cards were compromised as a result of the breach. The settlement must still be approved by a court and, as the recent Yahoo case demonstrated, that is not always just a formality.
The Wendy’s breach is said to have impacted 18 million payment cards issued by roughly 7,500 credit unions and banks. The fast food chain has agreed to pay $50 million to settle the lawsuit brought by these organizations, but it expects to pay only $27.5 million of that amount as the rest should be covered by insurance.
The company says the $50 million includes attorney fees and costs. If the deal is approved by the court, the payments will likely be made in late 2019.
“We are encouraged by the progress made to resolve this case, and we believe this settlement is in the best interests of Wendy’s and its shareholders,” said Todd Penegor, President and CEO of Wendy’s. “With this settlement, we have now reached agreements in principle to resolve all of the outstanding legal matters related to these criminal cyberattacks. We look forward to putting this behind us so that we can continue to focus on growing the Wendy’s brand.”
Related: Huddle House Suffers Payment Card Breach
Related: Neiman Marcus Reaches $1.5 Million Data Breach Settlement
Related: Lenovo Pays $7.3 Million to Settle Superfish Adware Lawsuit
Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- CISA Warns of Old JBoss RichFaces Vulnerability Being Exploited in Attacks
- NIST Publishes Final Version of 800-82r3 OT Security Guide
- Johnson Controls Hit by Ransomware
- Verisoul Raises $3.25 Million in Seed Funding to Detect Fake Users
- Government Shutdown Could Bench 80% of CISA Staff
- Google Rushes to Patch New Zero-Day Exploited by Spyware Vendor
- macOS 14 Sonoma Patches 60 Vulnerabilities
- New GPU Side-Channel Attack Allows Malicious Websites to Steal Data
Latest News
- Bankrupt IronNet Shuts Down Operations
- AWS Using MadPot Decoy System to Disrupt APTs, Botnets
- Generative AI Startup Nexusflow Raises $10.6 Million
- In Other News: RSA Encryption Attack, Meta AI Privacy, ShinyHunters Hacker Guilty Plea
- Researchers Extract Sounds From Still Images on Smartphone Cameras
- National Security Agency is Starting an Artificial Intelligence Security Center
- CISA Warns of Old JBoss RichFaces Vulnerability Being Exploited in Attacks
- Hackers Set Sights on Apache NiFi Flaw That Exposes Many Organizations to Attacks
