Antitrust Law Daily Wrap Up, FRANCHISING & DISTRIBUTION NEWS: Additional malware discovered in POS systems of franchised-operated Wendy's restaurants, (Jul 7, 2016)

By Edward L. Puzzo, J.D.

Malicious cyber activity targeting customers' payment card information has recently been discovered in additional franchise-operated Wendy's restaurants, Wendy's has revealed. Wendy's had previously announced its discovery and disabling of malware in the point-of-sale (POS) systems of approximately 300 franchise-operated Wendy's restaurants. The company believes that criminals first deployed malware on some Wendy’s franchisee systems starting in late fall 2015.

As a result of the company's ongoing investigation into unusual credit card activity, working with third-party forensic experts and federal law enforcement, a variant of the previously discovered malware has now been discovered in additional franchise restaurants' POS systems. The number of franchise restaurants impacted by these cyber security attacks is now expected to be considerably higher than the 300 restaurants already implicated. The malware used by attackers is highly sophisticated in nature and extremely difficult to detect, Wendy's stated. Upon detecting the new variant of malware in recent days, Wendy's has already disabled it in all franchise restaurants where it has been discovered.

Many franchisees and operators throughout the retail and restaurant industries contract with third-party service providers to maintain and support their POS systems, Wendy's noted. The company believes this series of cyber security attacks resulted from certain service providers' remote access credentials being compromised, allowing access to the POS system in certain franchise restaurants serviced by those providers.

Fraud and identity assistance. Reports indicate that payment cards used legitimately at Wendy's may have been used fraudulently elsewhere. Wendy’s has now arranged to offer one year of complimentary fraud consultation and identity restoration services to all customers who used a payment card at a potentially affected restaurant during the time when the restaurant may have been affected. A list of the potentially affected restaurants affected was to be posted on a Wendy's web page.

"In a world where malicious cyber attacks have unfortunately become all too common for merchants, we are committed to doing what is necessary to protect our customers," stated Todd Penegor, Wendy's President and CEO.

"We will continue to work diligently with our investigative team to apply what we have learned from these incidents and further strengthen our data security measures."

Companies: The Wendy's Co.

News: FranchisingDistribution Privacy