Krystal Data Breach May Have Involved Payment Cards

Oct 30, 2019 | Consumer Protection, Employment & Technology Archive

Kehoe Law Firm, P.C. Investigating Potential Claims on Behalf of Victims of Attack of One of Krystal’s Payment Processing Systems Used at Certain Krystal Restaurants

Kehoe Law Firm, P.C. is investigating potential claims on behalf of victims of a security incident that, according to the Krystal Company, “may have involved payment cards processed by a payment processing system used at certain [Krystal fast-food] restaurants between July through September 2019.”

If you believe you were a victim of Krystal’s data breach and have questions or concerns about Kehoe Law Firm’s data breach investigation or potential legal claims, please contact Kehoe Law Firm, P.C., Michael Yarnoff, Esq., (215) 792-6676, Ext. 804, [email protected], [email protected].  

Komando.com reported (“Check your credit card! Fast food chain breached”) that “[t]he South’s version of White Castle is dealing with a data breach. The fast-food company is still trying to determine how many people were affected, but it does know payment information was stolen.”  Further, Komando.com reported that “Krystal, the White Castle of the South, announced payment data was breached at a number of its restaurants. In a press release, the company admitted determining how many people were affected by the breach is difficult because its 342 locations use various payment processes.”

The Krystal Company’s “Notice of Potential Payment Card Incident” contained a list of its restaurant locations which might have been impacted by the payment card incident and stated, among other things, that “[a]lthough its investigation is in its early stages, [Krystal has] learned that the security incident may have involved payment cards processed by a payment processing system used at certain restaurants between July through September 2019.”

Krystal’s FAQs about the data attack stated, among other things, that the “security incident may have impacted payment cards, including debit and credit card numbers,” and Krystal is “still determining specific locations and dates for each restaurant involved in the attack.”

Have You Been Impacted by A Data Breach?

If so, please either contact Kehoe Law Firm, P.C. Partner Michael Yarnoff, Esq., (215) 792-6676, Ext. 804, [email protected], complete the form on the right or send an e-mail to [email protected] for a free, no-obligation case evaluation of your facts to determine whether your privacy rights have been violated and whether there is a basis for a data privacy class action.

Examples of the type of relief sought by data privacy class actions, include, but are not limited to, reimbursement of identity theft losses and of out-of-pocket costs paid by data breach victims for protective measures such as credit monitoring services, credit reports, and credit freezes; compensation for time spent responding to the breach; imposition of credit monitoring services and identity theft insurance, paid for by the defendant company; and improvements to the defendant company’s data security systems.

Data privacy class actions are brought on a contingent-fee basis; thus, plaintiffs and the class members do not pay out-of-pocket attorney’s fees or litigation costs.  Subject to court approval, attorney’s fees and litigation costs are derived from the recovery obtained for the class.

Kehoe Law Firm, P.C.

Hy-Vee Reports Findings of Data Breach Investigation

Oct 3, 2019 | Consumer Protection, Employment & Technology Archive

Hy-Vee’s Investigation Identified The Operation of Malware Designed to Access Payment Card Data – Kehoe Law Firm, P.C. Investigating Potential Claims on Behalf of Victims of Hy-Vee’s Data Breach. 

On October 3, 2019, Hy-Vee reported findings from the investigation of the payment card data incident reported by Hy-Vee in August 2019.  According to Hy-Vee’s announcement:

After detecting unauthorized activity on some of [Hy-Vee’s] payment processing systems on July 29, 2019, [Hy-Vee] immediately began an investigation and leading cybersecurity firms were engaged to assist. [Hy-Vee] also notified federal law enforcement and the payment card networks.

The investigation identified the operation of malware designed to access payment card data from cards used on point-of-sale (“POS”) devices at certain Hy-Vee fuel pumps, drive-thru coffee shops, and restaurants (which include [Hy-Vee’s] Hy-Vee Market Grilles, Hy-Vee Market Grille Expresses and the Wahlburgers locations that Hy-Vee owns and operates, as well as the cafeteria at Hy-Vee’s West Des Moines corporate office). The malware searched for track data (which sometimes has the cardholder name in addition to card number, expiration date, and internal verification code) read from a payment card as it was being routed through the POS device. However, for some locations, the malware was not present on all POS devices at the location, and it appears that the malware did not copy data from all of the payment cards used during the period that it was present on a given POS device. There is no indication that other customer information was accessed.

The specific timeframes when data from cards used at these locations involved may have been accessed vary by location over the general timeframe beginning December 14, 2018, to July 29, 2019 for fuel pumps and beginning January 15, 2019, to July 29, 2019, for restaurants and drive-thru coffee shops. There are six locations where access to card data may have started as early as November 9, 2018, and one location where access to card data may have continued through August 2, 2019. A list of the locations involved and specific timeframes are available below. For those customers Hy-Vee can identify as having used their card at a location involved during that location’s specific timeframe and for whom Hy-Vee has a mailing address or email address, Hy-Vee will be mailing them a letter or sending them an email.

Payment card transactions were not involved at [Hy-Vee’s] front-end checkout lanes; inside convenience stores; pharmacies; customer service counters; wine & spirits locations; floral departments; clinics; and all other food service areas which utilize point-to-point encryption technology, as well as transactions processed through Aisles Online.

During the investigation, [Hy-Vee] removed the malware and implemented enhanced security measures, and [Hy-Vee] continue[s] to work with cybersecurity experts to evaluate additional ways to enhance the security of payment card data. In addition, [Hy-Vee] continue[s] to support law enforcement’s investigation and are working with the payment card networks so that the banks that issue payment cards can be made aware and initiate heightened monitoring. [Emphasis added.]

Hy-Vee’s announcement contains a “Location Look Up Tool,” where individuals can determine the “specific Hy-Vee fuel pumps, drive-thru coffee shops, and restaurants [which] were identified during [Hy-Vee’s] investigation as well as the specific time frames.”  Hy-Vee also stated that not all of its locations were involved in the data incident, as well as that the data incident did not affect payment card systems inside of its convenience stores/gas stations.

Have You Been Impacted by A Data Breach?

If so, please either contact Kehoe Law Firm, P.C. Partner Michael Yarnoff, Esq., (215) 792-6676, Ext. 804, [email protected], complete the form on the right or send an e-mail to [email protected] for a free, no-obligation case evaluation of your facts to determine whether your privacy rights have been violated and whether there is a basis for a data privacy class action.

Examples of the type of relief sought by data privacy class actions, include, but are not limited to, reimbursement of identity theft losses and of out-of-pocket costs paid by data breach victims for protective measures such as credit monitoring services, credit reports, and credit freezes; compensation for time spent responding to the breach; imposition of credit monitoring services and identity theft insurance, paid for by the defendant company; and improvements to the defendant company’s data security systems.

Data privacy class actions are brought on a contingent-fee basis; thus, plaintiffs and the class members do not pay out-of-pocket attorney’s fees or litigation costs.  Subject to court approval, attorney’s fees and litigation costs are derived from the recovery obtained for the class.

Kehoe Law Firm, P.C.