Wendy’s Faces Class Action Lawsuit Over Data Breach
First Choice Federal Credit Union filed a class action lawsuit against Wendy’s on April 25, alleging that a five-month long data breach could have been prevented if the company would have acted faster.
The suit, filed in Federal Court in Pittsburgh, claims that Ohio-based Wendy’s “refused to take steps to adequately protect its computer systems from intrusion.” Hackers accessed Wendy’s computer systems and stole possibly millions of consumer credit cards that had been used at certain locations between October 22, 2015 through March 10, 2016.
“As a result of Wendy’s data breach, plaintiff and class members have been forced to cancel and reissue payment cards, change or close accounts, notify customers that their cards were compromised, investigate claims of fraudulent activity, refund fraudulent charges, increase fraudulent monitoring on potentially impacted accounts, and take other steps to protect themselves and their customers,” the lawsuit claims.
The lawsuit further alleges that Wendy’s used outdated and easily hackable computer and credit card systems, and said the fast-food chain did not meet federal regulations and guidelines. The company is accused of holding on to credit card information longer than necessary and not meeting the October 2015 deadline for EMV cards and terminals.
“Despite the growing threat of computer system intrusion, Wendy’s systematically failed to comply with industry standards and protect payment card and customer data,” the lawsuit states, noting that financial institutions have borne the brunt of the data breach.
A Wendy’s spokesman has said that malware was discovered by third-party investigators, but the restaurant chain has not yet confirmed how many of its 6,000 stores had been breached.
Wendy’s spokesperson Bob Bertini has not commented on the lawsuit, and has said only that the company is cooperating with cybersecurity experts and federal authorities.
“We are working with federal law enforcement and the card brands to ensure that the investigation and remediation is appropriate and comprehensive, and that will still take some time to fully complete,” Bertini wrote in an e-mail to Courthouse News.