What happened
Chipotle disclosed in May 2017 that point-of-sale malware had captured payment card track data at restaurants between 24 March and 18 April 2017, including cardholder name, card number, expiry date and verification code. The FBI attributed the intrusion to FIN7, naming Chipotle among the group's publicly disclosed US victims. FIN7 entered victim networks through phishing emails that employees opened, reinforced by follow-up phone calls.
How the deception worked
FIN7 emailed restaurant corporate and store staff with messages written to read as ordinary business correspondence, such as catering orders or complaints, carrying an attached document. Group members then telephoned the recipient, referred to the email they had just sent and encouraged the employee to open the attachment, which is the detail that made the campaign so effective: the voice call converted a suspicious attachment into an expected one. Opening the document installed a backdoor, from which the group moved to point-of-sale systems and deployed card-scraping malware. Across its victims FIN7 took more than 15 million card records from over 6,500 terminals.
The control that would have caught it· our reading, not a claim from the sources
Treat an unsolicited phone call that vouches for an emailed attachment as an escalation, not a reassurance, and block macro-enabled documents from external senders.
Sources (2)
- How Cyber Crime Group FIN7 Attacked and Stole Data from Hundreds of U.S. CompaniesFederal Bureau of Investigation·fbi.govOpen ↗
- Chipotle Mexican Grill Reports Findings from Investigation of Payment Card Security IncidentChipotle Mexican Grill·newsroom.chipotle.comOpen ↗
This entry summarises public reporting. It is not a legal finding, and details can change as investigations conclude. Found an error? Send a correction.