Blog

Assignment details

You are to write a report on a specific computer/network security breach. While you can certainly use the Verizon report as a tool to find a topic, give a report on a specific computer security breach, not a summary of the Verizon report.

Item 1 – Summarize the breach – What exactly happened? Please provide specific details.

Item 2 – What was the impact of the attack? What did the attackers do? Who was impacted? Was there any loss of money, integrity, privacy?

Item 3 – How did the attackers get in? What did they do to cause the infiltration? How did they get caught?

Item 4 – What did the organization that was attacked do as a result of the breach? Did they change, update or replace anything? Was anyone held accountable for the breach? Please elaborate and provide specific details.

Scoring – (5) points available

Point will be assigned for sufficiently and substantially answering each of the (4) items listed above.

Point will be assigned for a report that is easy to read, contains minimal typing, spelling and grammatical errors and is in the format of a report as listed below in note 1.

Introduction

According to contemporary research, most companies experience challenges in effectively maintaining their physical security. The advancement in technology is the main reason for the firms’ increment in vulnerabilities and threats. Further, the intervention and development of portable devices like USB drives, and smartphones, among others, are perceived to be the reason for a data breach in most organizations. Besides, the increased remote data accessibility has increased the susceptibility of the firm’s data to hackers. The paper discusses Arby’s data breach issue, exploring how the attackers gained access to the company, people impacted by the attack, and how the company dealt with the breach.

Summarize the breach – What exactly happened?

In line with the statement issued by the company, Arby informed the media regarding the breach and confirmed that the stealing of credit card data did not, in any way, impact any of the Arby’s restaurant franchises (Grotta, 2017). However, the malware that was installed within Arby’s business stores was found to be stealing extremely sensitive credit card data. Nonetheless, the news issued statement affirmed that the credit card information was stolen because of this breach though Arby’s was not notified or informed regarding the breach until mid-January (Hall & Wright, 2018). The company was later notified that the discretion was mainly since the FBI did not make the information public due to the fear of the chaos that the information could create if made public. Overall, Arby has declined to comment on specifics concerning the breach.

What was the impact of the attack? What did the attackers do? Who was impacted? Was there any loss of money, integrity, privacy?

The breach impact mainly influenced the point-of-sale systems of one-third of Arby’s stores, primarily its corporate ones, which could be approximately more than 1000 restaurants (Lam, 2017). The attackers, in a way, go the malware software onto these systems and all the credit card data utilized in these systems, hence compromising the information stored within the systems. Arby’s is perceived to have suffered a similar number of victims as that of Wendy’s when it was attacked, in which the credit unions had to pick up the slack on all the plausible fraudulent transactions of its attackers and possibly reissue new cards to its clients. After the attack on Wendy’s, some intuitions stopped approving any transactions to their restaurants until the break was effectively dealt with. Similar to Wendy’s, Arby’s is likely to suffer the exact cause until the breach is handled.

How did the attackers get in? What did they do to cause the infiltration? How did they get caught?

As stated previously, the Arby’s have not issued any official statement regarding the stores that were directly affected or the means on how they were attacked. However, KrebsOnSecurity links this attack to the recently occurred at Wendy’s systems. KrebsOnSecurity expressed that the malware can be installed through hacked remote administration tools or even through spear-phishing attacks, mainly targeting company workers (Lam, 2017). Once the malware is installed on their POS system, swiping credit card data through such systems can be captured. This data could be sold to the individuals with the ability to load the information in their cards with magnetic stripes and utilize it to buy gifts cards and high-end electronics from the big-box stores. In the case of Arby’s, the attackers were caught due to non-public notification given by PSCU, a credit union service firm that services above 800 credit unions (Grotta, 2017). The notification was issued to the clients’ financial institutions and established that more than 350 000 cards could have been compromised due to the attack.

What did the organization that was attacked do as a result of the breach? Was anyone held accountable?

Although the company is yet to issue a statement on the breach, it confirmed that it was received information, which necessitated the launch of an inquiry for all its payment card systems, informed the law enforcement and solicited the experts leading the security, and implemented certain measures of containing the incident and completely eradicate the malware from its systems. Thus, the only individuals responsible for Arby’s security breach are the PSCU and credit unions to cover the losses from the breach and issue new credit cards to its clients. Due to the incident, certain blame is placed on clients for using the cards with magnetic swiping rather than the cards with a chip (Lam, 2017). Overall, no one is officially responsible since the Arby’s has declined to issue any particular comments about the breach.

References

Grotta, S. (2017). Fast Food Chain Arby’s Acknowledges Breach. Paymentsjournal. Retrieved from: https://www.paymentsjournal.com/fast-food-chain-arbys-acknowledges-breach/

Hall, A. A., & Wright, C. S. (2018). Data security: A review of major security breaches between 2014 and 2018. Federation of Business Disciplines Journal, 6, 50-63.

Lam, K. (2017). Arby’s customers’ credit card information stolen in a data breach. Fox News. Retrieved from: https://pix11.com/news/arbys-customers-credit-card-information-stolen-in-data-breach/