Earl Enterprises earlenterprises.com Earl Enterprises data breach: what happened and what to do
Earl Enterprises, owner of Buca di Beppo, Earl of Sandwich and Planet Hollywood, disclosed on March 29, 2019 that malware on payment systems exposed card numbers, expiration dates and sometimes cardholder names. The exposure ran from May 23, 2018 to March 2019.
View all 13,177 breaches- Breach date
- 23 May 2018
- Made public
- 29 Mar 2019
- Data exposed
- Credit cards
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Earl Enterprises owns restaurant brands including Buca di Beppo, Earl of Sandwich, Planet Hollywood, Chicken Guy!, Mixology and Tequila Taqueria. It disclosed on March 29, 2019 that malware on its point-of-sale systems had captured payment card data. The California Attorney General's breach list gives the start of the breach as May 23, 2018.
Press coverage puts the end of the exposure in March 2019, so the malware ran for about 10 months. Not every location was involved. Reports say virtually all U.S. Buca di Beppo restaurants were, along with some Earl of Sandwich and Planet Hollywood sites. Orders paid for through third-party apps weren't affected, according to the company.
Sources checked: oag.ca.gov, restaurantbusinessonline.com, scworld.com
Last verified against the official page:
What was exposed
The malware targeted card numbers, expiration dates and, in some cases, cardholder names. The company didn't report Social Security numbers or passwords. Security reporter Brian Krebs, who first alerted the company, estimated about 2.15 million cards were involved. That's a press estimate, not a figure from the company.
Stolen card data is typically sold to people who make counterfeit cards or buy goods online. Card fraud is often covered by your bank, but you need to spot it first.
The company's response
Earl Enterprises said it worked with two cybersecurity firms and with federal law enforcement.
What this means for you
If you paid by card at one of these restaurants in that period, check your statements back to May 2018 and ask your card issuer about a replacement number.
What to do if you were in it
- 1
Check statements and report charges you don't recognize
Look back to May 2018 if you ate at one of these restaurants. Tell your card issuer about any charge you didn't make.
- 2
Ask for a new card number
If you used a card at an affected location, ask your bank or issuer for a replacement. It's usually free.
- 3
Turn on transaction alerts
Most banks can text or email you for every charge, so fraud shows up within minutes.
- 4
Report misuse
If someone uses your details, report it at IdentityTheft.gov to get a recovery plan.
- 5
Check whether your email or phone is in this and other breaches
A free Serus scan checks breach databases for your email, phone and other details and alerts you when they appear in a new leak.
Official filings
- California Attorney General , filed 29 Mar 2019
Timeline
-
The breach happened
-
The company made it public
-
Reported to the California Attorney General
Frequently asked
Was I affected by the Earl Enterprises breach?
Possibly, if you paid by card in person at one of its restaurants between May 2018 and March 2019. The company said third-party app orders weren't affected.
What was exposed?
Card numbers, expiration dates and, in some cases, cardholder names, per press reports of the company's notice.
Will my bank cover fraud?
Card issuers generally handle fraudulent charges, but you have to report them. Contact your issuer to ask.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
