Here’s How Old POS Systems Get Retailers Screwed
Understanding the potential implications of the Sonic breach to your business.
Hold the onions … and my personal banking info!
Two years ago, Sonic Drive-In experienced a massive Point of Sale system breach. In September 2017, financial institutions noticed fraudulent charges on numerous cards that had previously been used at the fast food chain. Days later, Krebs on Security reported that a batch of five million credit and debit cards had suddenly shown up for sale online. Krebs’ banking insiders bought some of the cards to investigate, confirming that they had indeed been recently used at Sonic.
Fast forward a year and a half to last May for the real day of reckoning. American Airlines Federal Credit Union—the financial institution that incurred most of the cost stemming from this breach—sued Sonic last spring to recoup millions in expenses.
“The credit union said that because of the breach, it had to cancel or reissue cards, close accounts, block transactions, refund affected customers and increase fraud monitoring efforts,” reported The Oklahoman. (Sonic is headquartered in Oklahoma City.)
Lawyers representing AAFCU claimed that “nearly a quarter of Sonic’s restaurants used POS systems that were nearly thirty years old.” More to the point, that ageing software wasn’t receiving security updates, making it vulnerable to malware that was used to hack it and collect credit card information.
The basic mechanics of a POS security breach
Krebs explained, in the article cited above, how hackers use credit card info.
“Malicious hackers typically steal credit card data from organizations that accept cards by hacking into point-of-sale systems remotely and seeding those systems with malicious software that can copy account data stored on a card’s magnetic stripe. Thieves can use that data to clone the cards and then use the counterfeits to buy high-priced merchandise from electronics stores and big box retailers.”
And you thought your mother-in-law was annoying.
Who gets stuck with the tab when a security breach occurs?
Breaches such as the Sonic incident and the prior Wendy’s breach are especially costly when the breached locations are independently-owned franchises rather than corporate-owned chains. In such cases, banks and credit unions that issue cards bear the up-front burden because cards tend to be breached, re-issued and breached again. The Wendy’s breach went on for nine months and was far costlier than the notorious Target and Home Depot breaches.
On Oct 1, 2015, much of the liability for credit card counterfeit schemes shifted from financial institutions to merchants. Those who had failed to adopt chip technology for processing credit cards were officially on the hook for damages stemming from in-store security breaches. In the last 3 ½ years the shift has been impossible not to notice in day-to-day consumer transactions.
Visa’s concise explanation of the EMV liability shift
The change of law has also pertained to several 7- and 8-digit legal settlements. For instance:
- Home Depot settled a similar suit brought against it by financial institutions, in the amount of $25 million in March of 2017.
- Wendy’s lost even bigger, settling for $50 million for its 2018 security breach.
- In addition to the AAFCU suit, Sonic settled a $4.3 million class action lawsuit on behalf of numerous customers. The settlement entitled individual customers to payments ranging from $10 to $40. It concerned all 325 locations that were hacked, listed here.
Writing 172,000 checks (that’s $4.3 million divided by the average of $10 and $40) sounds like an unpleasant way to spend the weekend.
The good news is that, even in the event of a security breach, you won’t be held liable if you’re compliant with PCI (Payment Card Industry) Data Security Standards.
What’s the solution?
Even if your POS system doesn’t predate household internet, you don’t want to leave security up to “common sense.” Whoever you’ve partnered with for your CRM and point of sale needs should be experienced, responsive, and able to discuss issues like PCI compliance in plain English. You don’t just want a vendor—you want a partner who can act as needed as an advisor.
Whoever you’ve partnered with for your CRM and point of sale needs should be experienced, responsive, and able to discuss issues like PCI compliance in plain English.
If you have less than complete confidence in your software, or you’re using antiquated hardware, hopefully this will encourage you to deal with it proactively. Making big changes may sound like a pain, but it’s also an opportunity: Modern POS and CRM solutions actually take a lot off your plate, including manual data entry, to running promotions and other marketing and administrative stuff.
Patrick began his career with RCS on August 8, 2016, by joining our implementation team and becoming the lead trainer and installer for our restaurant division. From his time working at his family-run restaurant to his own career in the industry, Patrick understands what it’s like to be in the customer’s shoes and after about a year became an Account Manager serving our Counterpoint clients. Patrick enjoys being able to work with such a great group of people that is always willing to help him or the customer succeed.
Matt found an opportunity at RCS after one of our managers visited his tech class for career day. Shortly after graduating in 2015 Matt joined our team on August 12th. Matt has spent the last 4 years building relationships with coworkers and customers big and small and values all the knowledge he’s gained since he began his career with us, he looks forward to many years to come!
Over the last 22 years Kellie has learned the ins and outs of how RCS operates, as well as our customers. In fact, at any moment you can quiz Kellie about a customer 15 years back and chances are she’ll remember them! Kellie began her career here at 19 years old and has seen RCS grow from 4 employees in a small office on the shore of Mascoma Lake to almost 60, 2 locations with 1/6 of the staff remote – spreading RCS across 6 states! Kellie’s day is always changing but loves working with her teammates to help answer any questions they have – which is good because she currently works in many departments as well as completes her full time job as the Executive Assistant of Dave Albert – all with a smile! Kellie has many thank you notes from customers and staff alike that she keeps as a reminder of the impact she makes on a daily basis.
If your retail system is running on Windows 7, it may coast along for a while, but it will ultimately be more vulnerable than ever to hacks. The bad guys of the world will likely be out to get anyone still running Windows 7, and they’ll do their best to breach systems.
Locavores were hilariously satirized in the oddball sketch comedy show Portlandia, in a skit where a couple at a restaurant asks a barrage of questions about the chicken. Is it organic? What kind of diet is it raised on? How much room do the chickens have to run around? Do you have a good relationship with the farmer?
Cegid is a high-end business solution for multi-location businesses. High-end clothing retailers and other retailers with 15 – 100 stores stand to benefit most from using it.
Indigo moved to a larger location in 2012 and Mia chose to combine both stores. When Bella and Indigo merged, it naturally meant consolidating their offerings as well. One of the things we admire about retailers is that they have to make a dizzying number of inventory management decisions under normal circumstances, so this must have been quite a challenge.
“The numbers on those reports really don’t lie,” Mia states. “It was very valuable to have that. We had so much history by then and that was really helpful.”
For all the advantages data provides, Mia’s choices aren’t all based on point of sale analytics.
