US fast food restaurant chain Wendy’s announced recently that it has reached a settlement with the thousands of financial institutions impacted by the data breach suffered by the company in 2015 and 2016.
Wendy’s discovered the breach in January 2016 after the payment industry noticed fraud patterns on some cards used at its restaurants. While initially it appeared that roughly 300 locations had been affected, the investigation launched by the company later revealed that the number of impacted restaurants actually exceeded 1,000.
The hacker attack, aimed at independently owned and operated franchise restaurants, involved a piece of malware designed to steal payment card information, including names, card numbers, expiration dates, and CVVs.
Wendy’s was sued by both customers and financial institutions. The company reached a $3.4 million settlement with customers last year, with each impacted individual being eligible for up to $5,000 in compensation.
Wendy’s last week announced that it also reached a settlement with the banks and credit unions whose payment cards were compromised as a result of the breach. The settlement must still be approved by a court and, as the recent Yahoo case demonstrated, that is not always just a formality.
The Wendy’s breach is said to have impacted 18 million payment cards issued by roughly 7,500 credit unions and banks. The fast food chain has agreed to pay $50 million to settle the lawsuit brought by these organizations, but it expects to pay only $27.5 million of that amount as the rest should be covered by insurance.
The company says the $50 million includes attorney fees and costs. If the deal is approved by the court, the payments will likely be made in late 2019.
“We are encouraged by the progress made to resolve this case, and we believe this settlement is in the best interests of Wendy’s and its shareholders,” said Todd Penegor, President and CEO of Wendy’s. “With this settlement, we have now reached agreements in principle to resolve all of the outstanding legal matters related to these criminal cyberattacks. We look forward to putting this behind us so that we can continue to focus on growing the Wendy’s brand.”
Related: Huddle House Suffers Payment Card Breach
Related: Neiman Marcus Reaches $1.5 Million Data Breach Settlement
Related: Lenovo Pays $7.3 Million to Settle Superfish Adware Lawsuit
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
Tags: 
