Panerabread.com leaks millions of customer records

So here's a fun note - as it turns out, the Panera Bread Director of Information Security mentioned in that email exchange worked at Equifax from 2009 to 2013. There's a comment mentioning it on that page, but you can find it just by looking at his LinkedIn: https://www.linkedin.com/in/mike-gustavison-b020426/

Time is a flat circle. Everything that has happened before will happen again. Every time it happens, we will hear "Security is our top priority" or "We take security very seriously."

EDIT: This just got more interesting. Turns out that despite taking the site down for an hour earlier today, they didn't fix it: https://twitter.com/briankrebs/status/980944555423002630

Also, based on the vulnerability still working at this endpoint [1], Krebs revised his estimated number to 37 million records: https://twitter.com/briankrebs/status/980949205974953984

________________________________

1. https://delivery.panerabread.com/foundation-api/users/678141...

Re: Panerabread.com leaks millions of customer records

#6

Post by changoplatanero » Mon, Apr 02, 2018, 11:10 PM UTC

Years ago, I was assigned to clean up an office building that had recently been vacated by a government cybersecurity contractor. While throwing away all the trash that had been left behind I discovered a binder that had at least a hundred pages of print outs from mapquest with the location of the panera bread on each circled in pen.

Re: Panerabread.com leaks millions of customer records

#7

Post by portofcall » Mon, Apr 02, 2018, 11:11 PM UTC

dsacco wrote: post #5

So here's a fun note - as it turns out, the Panera Bread Director of Information Security mentioned in that email exchange worked at Equifax from 2009 to 2013. There's a comment mentioning it on that page, but you can find it just by looking at his LinkedIn: https://www.linkedin.com/in/mike-gustavison-b020426/ Time is a flat circle. Everything that has happened before will happen again. Every time it happens, we will…

Don’t forget, “We’re sorry,” “We’ll do better,” and my personal favorite, “Trust us!”

I’d prefer crippling fines.

Re: Panerabread.com leaks millions of customer records

#8

Post by delfb » Mon, Apr 02, 2018, 11:15 PM UTC

changoplatanero wrote: post #6

Years ago, I was assigned to clean up an office building that had recently been vacated by a government cybersecurity contractor. While throwing away all the trash that had been left behind I discovered a binder that had at least a hundred pages of print outs from mapquest with the location of the panera bread on each circled in pen.

That could’ve easily been a really boring office lunch option binder, though. ;)

Re: Panerabread.com leaks millions of customer records

#9

Post by forgotmypw » Mon, Apr 02, 2018, 11:16 PM UTC

ams6110 wrote: post #2

The standard "we take security very seriously" is starting to ring a bit hollow.

I'm picturing one of the Pythons saying it emphatically while raising their eyebrows and nodding to the side a bit.

Re: Panerabread.com leaks millions of customer records

#10

Post by changoplatanero » Mon, Apr 02, 2018, 11:16 PM UTC

delfb wrote: post #8

changoplatanero wrote: post #6

Years ago, I was assigned to clean up an office building that had recently been vacated by a government cybersecurity contractor. While throwing away all the trash that had been left behind I discovered a binder that had at least a hundred pages of print outs from mapquest with the location of the panera bread on each circled in pen.

That could’ve easily been a really boring office lunch option binder, though. ;)

It was a hundred panera bread's from all over the East Coast. Something suspicious was going on...