Cyber Incident Victim: Wingstop Inc.
Date:
May 2012
Location:
United States of America
Summary
Malware infected point-of-sale systems at four independently operated Wingstop restaurant locations, potentially exposing customer payment card information including account numbers, expiration dates, and cardholder names, though PINs and contact details remained unaffected. The restaurant chain replaced compromised systems, implemented enhanced security measures, and offered affected customers identity theft protection services, while acknowledging an undetermined number of victims but confirming at least 20 payment cards from one location showed suspicious activity during the breach periods.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
In 2015, Texas-based restaurant chain Wingstop disclosed that malware had compromised point-of-sale (POS) systems at four independently operated locations, potentially exposing customer payment card data. The affected sites included establishments in Corpus Christi, Texas, and Union City, California, where malware was active from June 4, 2014, to July 31, 2014. A Grand Prairie, Texas location experienced two separate infection periods: May 5, 2012, to June 27, 2012, and November 11, 2012, to December 9, 2012. While malware was not confirmed at the Lubbock, Texas location, the company reported suspicious activity involving approximately 20 payment cards used there during a timeframe overlapping with other incidents. The malware specifically targeted cardholder names, account numbers, and expiration dates, with no evidence suggesting compromise of PINs, email addresses, or physical mailing addresses. Wingstop did not provide an estimate of affected customers but urged vigilance among patrons who visited these locations during the specified periods.
Upon discovering the breaches, Wingstop removed and replaced all internet-connected POS hard drives at the compromised locations with new systems. The company implemented enhanced security controls across its franchise network to strengthen POS system protections. All potentially impacted customers received offers for complimentary identity theft protection services valid for one year. Wingstop's public FAQ advised customers to review payment card statements for unauthorized charges and report suspicious activity to financial institutions. Forensic investigations found no evidence of malware on POS systems at other Wingstop locations beyond the four confirmed sites. The incident highlighted vulnerabilities in franchise-operated payment systems during a period of widespread POS malware attacks targeting the food service industry.