Following the news about the noodles & company is probing a credit card breach that is said to have hit several of its 500 stores. IT security experts commented below.
Brad Bussie, Director of Product Management, STEALTHbits Technologies: “Anti-virus and anti-malware are unable to keep pace with the emerging threats, and we are seeing that daily with company breaches. The thing to remember about malware is that it needs a delivery mechanism. Payment card systems and point of sale systems should be completely isolated and hardened to create a minimal attack surface. Organizations that allow removable devices, internet browsing, and email on payment card networks are literally asking for a breach. When you cut off the traditional methods of malware propagation, the number of breaches will fall significantly. Companies should re-evaluate the systems they have deployed and – if they’re not already – start putting security first. Malware is insidious.”
“The company has to be given credit for being relatively transparent about this. It’ll be up to their management team as to whether they want to post anything in company locations. There is a question as to how to notify customers who made purchases at affected locations. This probably won’t happen. There was a rather long window, 6 months, before this breach was discovered. Not good, and the company’s security team is going to have to step up the security they have in place.
“Noodles and Company is placing the onus on customers to examine their credit card bills for any unusual transactions (which should probably always be done by all consumers, anyway). Ultimately, customers who do see strange charges on the cards should follow the instructions given by the company. The advice is ‘standard practice.’
“Target offered customer’s whose credit card/debit card info was compromised a free credit watch service for a year. Noodles and Company may want to consider this for affected customers.”
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
Functional
Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes.The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.