Massive Breach in Panera Bread

You probably still could, if they ignored you then chances are they never fixed it.

You should post your method. I could scrape it for data if you want

You should contact Troy Hunt or Krebs. They can make that public to get companies to actually change it.

Hey, I work at Symantec Research Labs. If you still have not been able to get this looked at by someone from Denny's, I can probably have the right people take a look.

e-mail me at daniel_kats [at] symantec [dot] com

EDIT: please do not post your method publicly. That is a bad idea.

I anticipated this and made archived copies of the hyperlink referenced in the Pastebin entry in case they tried to pretend there was no leak.

https://www.webcitation.org/6yNwbyvu0

https://archive.fo/h9mjp

Oh no no no no no please don't tell me that's true D:

I’m American but I have made accounts with restaurants to order for pickup (or delivery). It’s especially helpful if you eat in an a busy area with long lunch lines. It’s also less error prone having the order in written form than trying to order over the phone. I think most restaurants use a vendor like Yelp for their ordering service, but I guess some big ones like Panera can afford to build one themselves (poorly).

If in doubt, put a catputer photo. Cats always look fabulous.

Update: It seems that error-cat has gone now. In resume, anybody could download a list of all people eating at this restaurants, their telephones, addresses, pastry preferences and last four numbers of their credit cards. Am I right? It seems that entering a single telephone they obtain a dozen of diferent users. Is a sort of wildcard or something?.

Wouldn't be much better to talk with Panera Bread directly?

To bypass the responsible disclosure versus full disclosure debate: I provided them with well over six months of time to fix this and reported it last year. My own data is in this set.

It's also possible that Panera would prosecute you for hacking their systems, if they were able to identify you. Better to be safe and disclose anonomyously.

It was given 6 months of lead time, but furthermore no researcher is under any obligation at all to consider corporate profits when releasing their research

>Disclosing this as such was irresponsible

How so? Is allowing a company a chance to patch a bug a responsibility that random people have to a company? What do those people get in return? Some companies will go as far as accusing the reporter of hacking them.

I might even go as far to say that if companies expect to be told of bugs and not have the information released to the wild, they will be less concerned with security because they can always patch the bugs as they come and perform the smallest disclosure they know of. Such an idea of 'responsible disclosure' may lead to less security overall.

Perhaps the responsible thing is reporting the breach to the public because they are the ones most hurt by it, so they can take immediate corrective actions.

Given the number of times well-meaning do-gooders have been prosecuted or sued after publicly disclosing a breach, I find this approach entirely reasonable.

The caveat, of course, is that the poster should definitely have first attempted to contact Panera. I would not be surprised at all if Panera responded by doing absolutely nothing, which eventually led to this post.