Panerabread.com leaks millions of customer records

Their bagels are also pathetic and embarrassing.

Most the IT Managers / Directors I've worked with were never from developer backgrounds. They were either an "IT Guy" that stuck it out or the "network guy" who's extent of knowledge is seemingly plugging in a network cable.

Between that and the fact most established businesses I've been in still treat IT like it's a necessary evil and waste of money, I'm not remotely surprised when stuff like this happens. My current company had a data breach, the IT Director swept it under the rug. I contacted my attorney for what I'm required to do to (to cover my ass). I emailed my managers and moved on down the road.

I find PCI compliance annoying mostly due to individual auditor predilections.

A debt collector would apply since they have been contracted by a HIPAA-covered entity and the data they have likely came from that source. Grindr is completely unrelated to another HIPAA-covered entity and any health data you give them is solely your responsibility... so don't.

Good read outlining the timeline of events from the person who originally reported the leak: https://medium.com/@djhoulihan/no-panera-bread-doesnt-take-s...

I found his initial interaction with their head of IT Security (very first initial response) laughably appalling:

    Dylan Houlihan 
    to Mike, Geri Haight -

    Hello Mike et al,

    Thank you for making yourselves available. There is a security vulnerability on the delivery.panerabread.com website that 
    exposes sensitive information belonging to every customer who has signed up for an account to order Panera Bread online. 
    This shows the customer's full name, email address, phone number and the last four digits of their saved credit card number.
    Moreover, the customers are easily enumerable which means an attacker could crawl through all the records.

    I can provide the specific details of the vulnerability over email once you respond, but if you prefer (for more security), 
    I can also encrypt the information with a PGP key you provide me. Alternatively we can hop on a phone call.

    Best regards,
    Dylan Houlihan

And their response:

    Mike Gustavison 
    to dylan

    Dylan,

    My team received your emails however it was very suspicious and appeared scam in nature therefore was ignored. If this is
    a sales tactic I would highly recommend a better approach as demanding a PGP key would not be a good way to start off. 
    As a security professional you should be aware that any organization that has a security practice would never respond to
    a request like the one you sent. I am willing to discuss whatever vulnerabilities you believe you have found but I will 
    not be duped, demanded for restitution/bounty or listen to a sales pitch.

    Regards,
    Mike