McDonald's customer data compromised through contractor

McDonald's is warning customers that sensitive data was exposed by a breach at a contractor hired by another contractor.

McDonald's is warning customers to be on guard against identity theft, phishing attacks, or other scams thanks to a data breach. What makes the data compromise more concerning is that it is indicative of a growing hacker strategy to go for the low-hanging fruit rather than staging a direct attack.

Hackers did not breach McDonald's per se. The attackers were able to access the sensitive McDonald's customer data through a third-party contracted by a third-party contracted by McDonald's. McDonald's hired Arc Worldwide to manage its promotional e-mail campaign, and Arc Worldwide hired another third-party to actually distribute the e-mails. That third-party -- which remains anonymous -- is the one that was hacked.

The good news for affected McDonald's customers is that the e-mail promotional campaigns do not involve collecting more sensitive information such as Social Security numbers, or credit card information. Still, data such as names, phone numbers, e-mail addresses, physical addresses, and other information that was exposed can be used for social engineering and identity theft attacks.

McDonald's has sent an e-mail to customers alerting them that their personal information may have been exposed. The e-mail asks customers to be more vigilant about potential identity theft or phishing threats, and asks them to contact McDonald's in the event that they receive any communications claiming to be from McDonald's which in any way ask the customer to share personal or financial information.

IT admins should pay close attention to this incident. Just as malware developers have focused more attention on third-party software like Adobe Reader rather than trying to exploit the Windows operating system directly, hackers have also learned that the easiest path to compromising a network is often through a third-party provider.

Partners and vendors often have trusted connections into fortified, high-value networks, and they represent low-hanging fruit that attackers can target. The smaller third-party organizations frequently lack the security policies and controls of the larger companies, and provide an Achilles heel that hackers can exploit to gain access to the more valuable network -- often flying undetected under the radar.

There are two things that IT admins need to do in order to protect sensitive data and network resources. First, do some due diligence and establish some security guidelines for third-party providers to ensure they meet security requirements. An extension of that would be to also require third parties contracted by the third party to meet the same requirements and go through the same vetting process before being authorized to connect to the network.

The other thing that IT admins should do is establish monitoring and controls to protect the network even from trusted partners, and prevent access to sensitive systems. It wouldn't help in this instance, because the compromised database was on the third-party provider's network, but IT admins still have to strike a balance between collaboration and security.

Like flowing water, attackers will always seek the path of least resistance. As this McDonald's incident illustrates, that path often goes through trusted third-parties.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags securitysoftwaredata protectionnetwork securityapplicationsfirewallsMcDonald's

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Tony Bradley

PC World (US online)
Show Comments

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Laura Johnston

MSI GS65 Stealth Thin

If you can afford the price tag, it is well worth the money. It out performs any other laptop I have tried for gaming, and the transportable design and incredible display also make it ideal for work.

Andrew Teoh

Brother MFC-L9570CDW Multifunction Printer

Touch screen visibility and operation was great and easy to navigate. Each menu and sub-menu was in an understandable order and category

Louise Coady

Brother MFC-L9570CDW Multifunction Printer

The printer was convenient, produced clear and vibrant images and was very easy to use

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?