A Data Breach Exposed Customers' Payment Information at More Than a Tenth of Checkers & Rally's Fast Food Restaurants

Recently, Checkers Drive In Restaurants, Inc., the company that owns the Checkers and Rally's fast food brands, proudly announced that its chains of drive-in restaurants are featured on Tampa Bay Times' Top Places to Work list. A Checkers or a Rally's restaurant might indeed be a good place to work, but up until recently, it wasn't necessarily the best place to use a credit card.

Checkers and Rally's restaurants hit by POS malware

Yesterday, Checkers and Rally's published two identical data breach notices on their respective websites. They announced that the POS systems at some of their locations suffered a malware attack which was designed to steal customers' payment card details.

The malware wasn't named, but Checkers and Rally's said that it was targeting the information contained on the card's magnetic stripe which includes the card's number, the cardholder's name, the verification code, and the expiration date. It was found on the POS systems of 102 restaurants situated in 20 states which equates to just under 12% of all Checkers and Rally's locations.

The company also managed to find the exposure periods for every location, and the dates are rather disturbing. The earliest attack breached a Rally's restaurant in Los Angeles. The malware hit in December 2015 and remained on the POS system until March 2018. The information stealing operations went on for quite a few months at many of the other affected locations as well, which means that the number of potentially affected customers could be rather significant.

What do you need to do?

Checkers and Rally's have hired data security specialists and are working with law enforcement to ensure that cardholders are protected. For the time being, the fast food chain can't say how many individuals were affected, but the fact that it published the exact dates of infection and removal of the malware does mean that you can have a look at the data and think about where you have used your card during the period of exposure. If you believe that your card might be compromised, there are a few things you can do to limit the damage.

The first one is pretty obvious – keep a close eye on every single transaction in your bank statement, and if you see something you don't recognize, get in touch with your bank immediately and ask them to resolve the issue. You can also request your free credit report from the consumer reporting agency of your choice, and if you think that the risk of identity theft is particularly high, consider placing a security freeze on your credit file.

There are no technical details at this stage, which means that it's difficult to say how well prepared Checkers and Rally's were for this type of threat. The fact that the malware remained undetected for over two years at some of the locations, however, suggests that the security probably wasn't top-notch.