Panera Bread Accidentally Leaked Millions Of Customers’ Info For 8 Months

Screenshot by Dylan Houlihan

Panera Bread had millions of customers’ credit card numbers, birthdays, email addresses, and home addresses out in the open for 8 months, according to Krebs on Security.

Apparently, in plain text, any customer who had ever signed up for an account on the Panera Bread site, had their personal information, down to their food preferences, visible directly on the site.

https://t.co/Y2Phv4yUdo, the Web site for the bakery-cafe chain by the same name, leaked millions of customer records — including names, DOBs, email/street addresses, last 4 of credit card — until today: https://t.co/S3sIx99HyG Worst part: They were first notified 8 months ago pic.twitter.com/QBw5lj6FmD

— briankrebs (@briankrebs) April 2, 2018

The problem was initially brought to Panera’s attention by security researcher Dylan Houlihan, whose information was also leaked on the Panera site. This was back in August, 2017, as Houlihan posted his story to Medium, showing screen shots of his conversation with Panera’s Information Security Director Mike Gustavison. Gustavison said they’d take care of it, and 8 months later, as Houlihan kept tabs on the Panera site, nothing had been done.

That is when Brian Krebs of Krebs On Security brought it to Panera’s attention, Monday. Krebs is one of the most credible sources for data breaches such as this, and Panera acknowledged him as well. Panera said the issue was taken care of, but two hours later, the information was still publicly visible.

That’s two different people, two separate acknowledgments, and two promises that it’d be resolved, but nothing was done — for eight freaking months.

Hey Panera, despite your statements to the contrary, you still haven’t fixed this customer info leak. Would you like to revisit the 10k number you just gave to Fox news? https://t.co/AJeiq6Dfd0

— briankrebs (@briankrebs) April 2, 2018

That’s when Krebs really pressed Panera on Twitter, vociferously calling them out for telling Fox News that only about 10 thousand customers were affected, downplaying the number. In reality, Krebs believes that more than 7 million people could have been affected, although official numbers have not been publicly released yet.

Basically, Panera’s security team didn’t give a shit about the leak until they were publicly under fire. Millions of customers had sensitive information flapping in the breeze, and for some unknown reason, Panera did nothing to protect them.

If you click on the links now, they are dead, and no longer show the information. Krebs said there is no evidence of it being a problem, but we are still waiting on Panera to respond and assure everyone that it has finally been resolved.