Glazed and confused: Hole lotta highly sensitive data nicked from Krispy Kreme

Krispy Kreme finally revealed the number of people affected by its November cyberattack, and it's easy to see why analyzing the incident took the well-resourced company several months. According to a filing with Maine's Attorney General, cybercriminals compromised data belonging to 161,676 people, and what a haul they had …

[nematoad]

Horse, stable door, etc.

"Krispy Kreme took the appropriate steps to secure our systems following the incident and continues strengthening the security of our systems to further protect the privacy of the data entrusted to us."

A bit bloody late now!

And what about all the stuff that they demanded and then stored in an easily accessible form?

No fines, no slap on the wrists, this calls for jail time.

Oh, I just noticed, this is a US based story.

As you were.

[Mentat74]

So their donuts...

Aren't the only thing they have with holes in it...

[KittenHuffer]

Re: So their donuts...

Wholely Holy holes! .... said Batman to Robin!

Perhaps that should consult with Nestlé to find out how they have protected the holes in Polos since 1948!

--------> Mine's the one with no holes ...... yes, I know that technically with no holes it has no sleeves, so it isn't really a coat!

[Anonymous Coward]

Re: So their donuts...

At one point you used to be able to buy little tubs of polo holes. They even fitted perfectly into a polo!

[nobody who matters]

Re: So their donuts...

<......."......consult with Nestlé to find out how they have protected the holes in Polos since 1948!"......>

Rowntree actually had them on the verge of being put into production at the end of the 1930s, but the war and the rationing of sugar meant that they were not able to start manufacturing them until 1948.

Nestle have only been responsible for the security (of the) holes since 1988, which was when they acquired Rowntree Mackintosh (Rowntree & Co and John Mackintosh & Co having merged in 1969), so presumably the current safeguarding of the holes has been a continuing development from the measures that were already in place under Rowntree.

[O'Reg Inalsin]

Re: So their donuts...

Pep-O-mint "Life Savers" have been sold in the US since the 1910's. https://clickamericana.com/topics/food-drink/life-savers-candy-history-flavors

[Anonymous Coward]

Alarming gaps

So the "health information" includes the state of their consumers' teeth?

[Anonymous Coward]

Re: Alarming gaps

.. and, given their audience and the consequences, probably their BMI ..

[sedregj]

Re: Alarming gaps

"...probably their BMI "

Oh Lord Him a'commin'

[Gene Cash]

Re: Alarming gaps

This isn't customers... this is mostly employees & their families

[nobody who matters]

Re: Alarming gaps

As the stolen data includes credit and debit card information along with their associated PIN, I would think it likely that it includes customer data too. Judging from the sloppy way they seem to have stored information lumped together on the same systems, I think it pretty unlikely that customer data was being stored properly segregated from employee data.

A significant proportion of the data apparently stolen appears to be the sort of things that they had no justification for recording in the first place, much less retaining it within their systems, regardless of whether it was from customers, employees or their families.

[Phil O'Sophical]

Retaining CVV numbers (prohibited by card industry rules)

That alone should have their CFO and CIO in jail.

[Anonymous Coward]

Nah, they'll just book a room at Trump tower for a few nights and buy some Trump coin and that'll be it.

The US no longer has a justice system, only a legal system.

[ecofeco]

You are under the mistaken impression the USA EVER had a justice system.

[Brewster's Angle Grinder]

Certainly the credit card companies should take action.

Realistically, they should suspend processing, demand their chosen experts examine the code and not allow processing to resume till they are satisfied its safe. (No different to Boeing having to ground planes until they can prove they are safe to be in the air.) Regular inspections should continue for the next five years. And their fees should be raised till then.

[Ben Trabetere]

For this alone Krispy Kreme could/should face $9M - $15M in Payment Card Industry Data Security Standard (PCI-DSS) fines. It also risks losing credit/debit card privileges, even if only temporarily, which would have a bigger, more immediate impact on its business.

[MachDiamond]

"It also risks losing credit/debit card privileges, even if only temporarily, which would have a bigger, more immediate impact on its business."

If a customer doesn't have cash on hand to buy a some fat pills, they shouldn't be buying them.

I learned a long time ago that making lots of small purchases with a debit card is a sure way to lose track of one's checking account. I also find it a good thing to buy little things with cash as a way to manage impulse purchases. I only have so much cash on me and if I'm planning to have a coffee with somebody later in the day, I can't go blowing all of it early in the day.

[Detective Emil]

Aaargh!

I trust that the sub-editor responsible for the headline has already collected theirs --->

[Little Mouse]

"The company has never mentioned the R-word anywhere"

The R-word is forgivable. The N-word is not.

Negotiation.

[elsergiovolador]

Customers

Customers got their rusty ring glazed very well.

[that one in the corner]

US military ID numbers

Glad to know that they did check people were properly inducted into the military and had, presumably, passed basic training in the safe handling of dangerous equipment.

Some of the Krispy Kreme displays in motorway services make Dwarf bread look as harmless and innocent as a Mountstevens' Congo Bun. Stack up a dozen KK Signature Glazed Originals from that stand and it'll turn away a nine-inch Stiletto Croissant from Bloodaxe's Artisanal Bakery, 12, Treaclemine Street (now carrying a full line of waffle holsters and eclair scabbards; Bloodaxe Buns, You Can't Bite 'Em).

[Anonymous Coward]

Same old story

It's getting really boring reading the same old story time and time again, in fact after the first paragraph I glazed over

Geddit?

[The Oncoming Scorn]

Re: Same old story

Do nut start the puns!

[Blofeld's Cat]

Re: Same old story

No, that would not be fair to the hundreds and thousands affected.

[ChrisElvidge]

Ambulance chasers

"Several US law firms are now appealing to aggrieved individuals to join potential class action lawsuits against the company"

About time the lawyers fees for class action lawsuits were capped (by law). How much extra work is involved when a class action lawsuit grows from 10 to 100 to 10000 plaintiffs?

[spireite]

Wonder if the miscreants will offer something to sugar the deal.

[RM Myers]

What is your problem?

To the one, and as far as I can tell, only cyber criminal on the planet who hasn't stolen my private information, what is your problem? Are you too lazy or too ignorant ? Do you think you're too important to lower yourself to my level? Am I not rich enough or important enough for you? My Urologist, my insurance companies, my utilities, hell even my city government has done their best to make sure my information is freely and readily available to anyone with internet access, and you can't be bothered?

You are a disgrace to the whole cyber criminal community. Get with the program - this is the twenty first century, not the stone ages.

Okay, sorry for the rant. I'm going to take my meds and have a lay down. Crooks these days just don't live up to the standard set by my generation.

[Andy Non]

Doh!

Nuts!

[cookiecutter]

Until firms and CEOs are PERSONALLY legally liable

This will carry on....ALL those details because I bet some idiot in Marketing wanted those details. Peoples lived will LITERALLY be ruined & yet nothing will be done except maybe a 12 month subscription to some credit reference agency that also got hacked previously.

It's a genuine fucking joke! And I Can already see the replies from the corporate bootlickers who will say things like firms shouldn't have to pay 100% of ANY costs associated with a breach, including hiring people to help customers whose details were stolen to get brand new ID. documents, brand new Social Security numbers and also be liable for ANY costs for the next decade after any breach.

If you can't secure your. network, you shouldn't be on the internet or even have a computer in your business. How many senior management will be fired from Marks and Spencers & how many of the historic management who made the decision to outsource and offshore to the jokers Tata will have their wages and bonuses grabbed back to compensate anyone whose had their details stolen?

thats why I lie on my DOB, my graduation date, bloody everything I can when I sign up & if someone wants me to put TRUTHFUL details into a We Work application, fuck em, I'm not THAT desperate for a job.

I don't know whether anyone here remembers Operation HoneyTrap, I think it was called...where the FBI setup a CSAM website back in the day. Recorded everyone who used credit cards to sign up for the service. Then forwarded details to local law enforcement around the World. Of course the British police were too stupid and lazy to understand that credit card details could be stolen, especially at that time when card scanners etc were all over the place & websites were being hacked left and right. I mean how much compensation has Target paid to people considering that EVERY password dictionary came from its original hack where they were stored unencrypted?

Of course LOADS of people got arrested. Innocent people. Many of whom went to jail, some of whom are probably STILL there and several committed suicide even though they didn't do anything wrong because assholes thinks "where's there's smoke theres fire".

And yet, tech bootlickers here and other places STILL make excuses for corporations and rich CEOs to negate their duty to secure OUR data because they know it won't affect THEM.

[Anonymous Coward]

Re: Until firms and CEOs are PERSONALLY legally liable

Dude, calm down, you'll have a coronary

[Probie]

Re: Until firms and CEOs are PERSONALLY legally liable

This is what too many Krispy Kremes does to you. As for Marks and Sparks - dust not settled on that yet, "where there is blame there's a claim" or in the UK legal profession "Where there is harm, its a charm".

[MachDiamond]

Re: Until firms and CEOs are PERSONALLY legally liable

"thats why I lie on my DOB, my graduation date, bloody everything I can when I sign up"

It wasn't until later in life that I met somebody that triggered an "ah hah" moment about creative lying. I was trained in childhood to always be truthful. That turns out to be a lot like using idealized components in electronics. It's a good first approach that must be discarded as one learns more and can discern when it's appropriate to use a more detail model, ie, get a bit more creative.

Today, phone numbers are the universal tracking tags. People can keep their numbers nearly forever if they don't shift countries and have to at least add a local number. Do that and you have two. Add a business line and the bad guys can triangulate you fairly easily. It might be that in future, people are assigned one at birth and the dossier starts from there. The phone number I give out when there's no need for some requester to have my number is a test number that just rings. Also handy that the area code is for Washingtion, DC. I have recently signed up for a new number to leave my old one behind over the course of a year. I've had the old one for far too long. I have long lived email addresses that I use with friends and family, others for handing out to utility companies and so forth and a huge number of temp addresses I set up and throw away several times per year. Anything that only needs my email for a short period of time gets a temp address. If I need the connection longer, I update them with my new temp address. If it becomes a semi-permanent thing, they'll get one of the longer permanence ones. The beauty of having my own URL's rather than using gmail or another free service. I do have a gmail address. It's only used for one thing on a phone that has no SIM. When I need to update a couple of free apps, I'll borrow a cup of WiFi from somewhere, log into the play store and get updated.

I'm as lazy as the next guy so I try to figure out ways to keep off lists that don't take lots of effort. Years and years ago, I stopped using my physical address for anything where there wasn't a law (driving license, etc). My driving license shows my PO Box address since that's allowed. Law enforcement can see my physical address if they run my license so I hope they don't get hacked (again?). My objective was to get off and stay off mailing lists. UPS, FedEx and DHL sell mailing lists which I why I have also signed up at the post office to allow them to receive packages on my account. I just use the physical address of the local post office with my box number appended.

[Homo.Sapien.Floridanus]

at the negociation...

IR: We are ready to transfer the digital currency..

Hacker1: Like, who cares about that, we want payment in delicious jelly filled donuts, right Scoo- err... I mean Gh0sHakk3r.

Hacker2: Rats right!

[Anonymous Coward]

"As you ramble through Life, Brother,

Whatever be your goal.

Keep your eye upon the doughnut,

And not upon the hole."

[Ken Shabby]

Johnny Cradock wants to know…

Do their doughnuts look like Fanny’s

[Anonymous Coward]

A variation on Homer's "Ode to the Donut"...

"Shambling through life, you klutz,

No matter how futile your goals,

Keep your eye upon the nuts^†,

And not upon the arseholes."

_{† particularly those holding sharp knives or high office.}

[Anonymous Coward]

Why are they called donuts when there aren't any nuts in them?

[Roj Blake]

Re: Why are they called donuts when there aren't any nuts in them?

An archaic definition of nut is "a small cake or biscuit"

[EnviableOne]

Data Minimization

Man, am I glad for the data minimisation principle in GDPR.

They would never have been able to justify storing all this in the Federated States of Europe.

[JulieM]

Better Question

A better question would be, why is a vendor of doughnuts even storing sensitive information in the first place?

You only need to hold onto a user's credit card details long enough to send them to the payment provider. There is simply no reason for them ever to touch oxide. If your equipment is so flaky that you can't complete the debugging of your integration using purely in-RAM storage of some form, you have drier lentils to soak.

[Anonymous Coward]

Re: Better Question

A better question would be, why is a vendor of doughnuts even storing sensitive information in the first place?

In earlier and more innocent days I assumed the model for payments in e-commerce was (or would be) the customer's order and pricing would be acquired by the merchant's site (shopping trolley), a unique transaction id generated and included in an cryptographically protected payment request that is forwarded to a secure payment gateway site where the customer might complete the transaction with a secure receipt returned to the merchant.

Clearly in this model which to me still seems the sanest, not only doesn't the merchant retain card details but never has those details to store in the first place.

Payment gateway provides should be highly regulated and precluded from conflicts of interest such as owning or being owned by a merchant. Ideally a purely standalone entity or an arm's length entity operated by a consortium of fully licenced resident financial institutions (commonly banks.)

As for the other information any entity that stores client information, that entity should have the statutory reason for that data retention and period of storage annotating that data. That is only client data that is permitted by law to be stored may be retained for the period and for the purposes permitted and no other; the onus of proof is on the entity. The sanctions need to be entirely criminal and flow up organisational chart to the chair and board - similar to WH&S culpability in some jurisdictions.

For my part I am not a vindictive man but I would be entirely happy for whole Krusty clown show to be sold off, the c-suite and board sold for spare parts with the proceeds shared between the victims and employees.

[Mr Dogshit]

How come Americans have a Social Security number, yet no social security?

[Anonymous Coward]

we do, but you have to earn it. Which I am fine with. I just wish they would quit raising the age to collect.

[ecofeco]

Soooo... if you can't actually collect, have you actually earned anything?

Except derision for being suckers?

[MachDiamond]

"How come Americans have a Social Security number, yet no social security?"

Well, I suppose they could have named it "yet another tax taken from your pay", but that didn't have a friendly ring to it.

[Knightlie]

Passports and government IDs of *employees family*?? This company should be wound up immediately, this is one of the most egregious breaches I've ever seen.

[Ken Moorhouse]

Hackers that did their homework

https://www.facebook.com/realratedred/posts/yes-krispy-kreme-really-does-give-out-free-doughnuts-for-good-grades-but-there-a/1070025341826867/

...and took away a lot more than free donuts.

[spold]

So do they put the red light on...

when your data is being exfiltrated?

(they used to put a red light on when there was a fresh batch of doughnuts)