Burgerville Notifies Guests of Data Breach

Restaurant chain has contained the breach and offers information to those potentially impacted

This from a Burgerville press release today –

PORTLAND, OR (October 3, 2018) – Today, Burgerville announced that the company’s network was impacted by a cybersecurity breach. The Federal Bureau of Investigation (FBI) notified Burgerville about the sophisticated cyberattack in late August 2018. The company has been cooperating fully with law enforcement. The security breach has been fully contained and Burgerville is now taking steps to inform those impacted by the intrusion.

In an abundance of caution, Burgerville is encouraging anyone who has used a credit or debit card at any of its locations between September 2017 and September 30, 2018, to consider that their card information may have been compromised.

Potentially impacted customers should:

• Review their card statements for any unauthorized charges. If there is something suspicious, they should contact their credit or debit card company immediately to report the activity.
• Obtain a copy of their credit report and look for unauthorized activity there, too. People can get a free copy of their credit report once every 12 months from each of the three top credit reporting agencies. To obtain an annual free credit report, please visit www.annualcreditreport.com or call 1-877-322-8228.
• They may also want to consider freezing their credit. As of September 21, 2018, freezing credit is a free service provided by the three major credit bureaus. Customers can go to each of the credit bureau websites listed below and locate the security freeze information.
  • For Equifax: www.equifax.com/personal/credit-report-services/
  • For Experian: www.experian.com/freeze
  • For TransUnion: www.transunion.com/credit-freeze
• Burgerville has set up a call center for concerned customers with further questions. Call 1-855-336-6688 (toll-free, US only) anytime between the hours of 6:00am-6:00pm (PST) Monday through Saturday.

 

Background on the Breach

On August 22, 2018, the Federal Bureau of Investigation notified Burgerville of a cybersecurity breach. Burgerville agreed to cooperate fully with the FBI investigation, and immediately began a forensic investigation of its own to determine the full extent of the breach.

On September 19, 2018, as part of its forensics investigation, Burgerville discovered that the breach, which was initially thought to be a brief intrusion, was still active. The group of hackers had placed malware on Burgerville’s network to collect data on an ongoing basis. In cooperation with the FBI, Burgerville immediately began taking steps to contain the breach and disable the malware with the help of a third-party team of cybersecurity experts.

From the moment Burgerville was contacted by the FBI, the company has been fully engaged in a forensic investigation. As soon as Burgerville learned the malware was still in effect, a multi-phase remediation plan was activated. This has included cutting off the various pathways the intrusion affected and upgrading systems to eradicate this breach.

Over the course of the investigation, it was determined that some of Burgerville’s customers’ credit and debit card information, including names, card numbers, expiration dates, and the CVV numbers found on the back of most cards may have been compromised.

The organization responsible for this breach is believed to be Fin7, an international cybercrime group. On August 1, 2018, the U.S. Department of Justice issued a press release announcing the apprehension of three members of this group who have been connected with launching cyberattacks on more than 100 companies across 47 states. The press release, which calls the hacker group a “sophisticated criminal enterprise,” mentions that there was a wave of attacks on companies with locations specifically in Western Washington, which includes Burgerville. More information about Fin7’s most common tactics can be found here on the FBI website.

“Beyond a breach of information, this type of intrusion impacts our entire community––Burgerville’s customers, vendor partners, employees, and the entire eco-system of the place we call home, the Pacific Northwest,” said Jill Taylor, interim CEO of Burgerville. “Unfortunately, these types of breaches are all too common today and they are taking a toll on people’s ability to feel safe and to trust one another—core tenets of building a resilient community. From our mission: Serve With Love, we stand committed to being a good partner and helping to build confidence with the community that has given us so much.”

Customers with further questions or concerns about this cyberattack are encouraged to visit Burgerville’s website at www.Burgerville.com/security, or call 1-855-336-6688 (toll-free, US only) anytime between the hours of 6:00am-6:00pm (PST) Monday through Saturday.

 

About Burgerville

Established in 1961, Burgerville, headquartered in Vancouver, Washington, is an innovative and industry-leading restaurant company with 42 locations throughout Oregon and Southwest Washington. Over 1,500 employees strong, the hometown favorite brings guests seasonal, local food from 989 Northwest family farms and ranches. Burgerville is built on a tradition based in its mission: “Serve With Love.”