If you’ve used a credit card to pay at a Subway in the last couple of years, it turns out you may have paid more than you bargained for. Four Romanian hackers have recently been charged with stealing over 80,000 credit card details from 150 franchises of the American sandwich chain and, according to arstechnica.com, lack of formidable security is partly to blame.
Although Subway dictates to all its franchises that it should have point-to-point encryption and other necessary cyber security precautions in place, many of the franchises hacked were not following these rules. This left glaring gaps in its systems, which hackers took advantage of with relatively unsophisticated methods. The Justice Department alleges that the hackers gained access by cracking uncomplicated or obvious passwords, such as “password”, and then deployed common hacking tools to log credit card scans.
This type of attack is becoming more and more common for small businesses especially. Following Sony’s breach, large companies are beginning to realise the importance of safeguarding themselves against hack attacks and privacy breaches, whilst smaller companies are taking a little longer to catch on. Partly, it’s because the risk, especially for small retailers and franchises such as this, seems remote, making it easy to cut corners.
Hackers, however, seem to be changing their tactics. This particular band of criminals allegedly stole from 50 other small retailers at the same time as Subway. Although the benefits of hacking a large company might appear greater, this type of attack is much easier and can slip under the radar for a longer period of time. This is something small businesses everywhere should be considering now and in the future.
See the full story on arstechnica.com