Subway restaurant chain was hacked, users received emails with links to malware Maria Nefedova a day ago 1 comment 2918

[root]

Media reports ( one , 2 ) that the British subsidiary of the Subway restaurant chain suffered from the hack. The cybercriminals sent malicious emails to the Subcard loyalty program participants, allegedly containing order data, but in fact leading to the download of the TrickBot Trojan.


Let me remind you that TrickBot is a very dangerous malware that allows you to steal saved passwords from the browser, can spread over the network, steal cookies, RDP, VNC and PuTTY credentials, and much more. Even worse, TrickBot may end up giving ransomware operators (like Ryuk or Conti) access to the infected system.



Since strange emails received by users contained real customer names and were directed to email addresses that some had created specifically for Subway, it was immediately suspected that the company had been hacked, and hackers gained access to the system used for marketing campaigns.





At first, the company only indirectly confirmed that a hacker attack had taken place:

“We are aware of some outages in our email systems, and we understand that some of our guests received unauthorized emails. We are currently investigating this issue and apologize for any inconvenience caused. "

But a little later, Subway representatives told reporters that their server associated with mail campaigns had indeed been hacked:

“After investigating the incident, we have no evidence of hacking of our guests' accounts. However, the system that runs our email campaigns has been compromised, resulting in a phishing campaign that uses the names and email addresses of [our users]. Our system does not store bank account numbers or credit card details, ”Subway representatives write and recommend deleting suspicious letters without opening them.

Subway has already begun sending out data breach emails to affected customers. These messages say that due to the attack, the names and email addresses of users were revealed to outsiders.


It is not yet clear how many people could have been affected by the incident, and whether hackers could have gotten to any data other than those mentioned above.