Massive Breach in Panera Bread
pastebin.com
Massive Breach in Panera Bread
1–10 of 44 posts
Re: Massive Breach in Panera Bread
#2Wow, this looks pretty bad.
Re: Massive Breach in Panera Bread
#3Wow, this looks pretty bad.
If in doubt, put a catputer photo. Cats always look fabulous.
Update: It seems that error-cat has gone now. In resume, anybody could download a list of all people eating at this restaurants, their telephones, addresses, pastry preferences and last four numbers of their credit cards. Am I right? It seems that entering a single telephone they obtain a dozen of diferent users. Is a sort of wildcard or something?.
Wouldn't be much better to talk with Panera Bread directly?
Re: Massive Breach in Panera Bread
#4Perhaps I'm naïve, but the fact this "breach" is being disclosed anonoymously, via a medium commonly associated with nefarious data dumps suggests to me that there really was little consideration paid to allowing Panera an opportunity to correct this situation.
Disclosing this as such was irresponsible, despite being an important discovery.
Re: Massive Breach in Panera Bread
#5Verified this is legit.
Re: Massive Breach in Panera Bread
#6Perhaps I'm naïve, but the fact this "breach" is being disclosed anonoymously, via a medium commonly associated with nefarious data dumps suggests to me that there really was little consideration paid to allowing Panera an opportunity to correct this situation. Disclosing this as such was irresponsible, despite being an important discovery.
To bypass the responsible disclosure versus full disclosure debate: I provided them with well over six months of time to fix this and reported it last year. My own data is in this set.
Re: Massive Breach in Panera Bread
#7Wow, this looks pretty bad.
If in doubt, put a catputer photo. Cats always look fabulous. Update: It seems that error-cat has gone now. In resume, anybody could download a list of all people eating at this restaurants, their telephones, addresses, pastry preferences and last four numbers of their credit cards. Am I right? It seems that entering a single telephone they obtain a dozen of diferent users. Is a sort of wildcard or something?. Wouldn…
[deleted]
Re: Massive Breach in Panera Bread
#8Oh boy. I just verified this with a few phone numbers of folks that I know personally, and their personal data came back just fine. This isn't good! I hope it's patched ASAP.
Re: Massive Breach in Panera Bread
#9Verified the vulnerability, but it looks like they have taken down the API now.
Hopefully they will publicly acknowledge.
Re: Massive Breach in Panera Bread
#10API seems to be down for maintenance. Nice to see Panera is taking action, sad to hear that this seems to be way, way after the original vulnerability was reported.