SONIC Corp. sonicdrivein.com Sonic data breach 2017: what happened and what to do
In September 2017, Sonic Drive-In's card processor flagged unusual activity on cards used at its restaurants. Sonic said malware at some locations may have exposed credit and debit card numbers. Reports put the total at up to 5 million cards; Sonic gave no figure.
View all 13,177 breaches- Breach date
- Sept 2017
- Made public
- 4 Oct 2017
- Data exposed
- Credit cards
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
In late September 2017, Sonic Drive-In said its credit card processor had told the company about unusual activity on cards used at its restaurants. Security reporter Brian Krebs broke the story. On October 4, 2017, Sonic published a notice saying credit and debit card numbers may have been acquired without authorization through a malware attack at certain Sonic Drive-In locations. Sonic said it briefly delayed the notice to accommodate a law enforcement investigation.
Sources checked: franchising.com, fraud.org, consumer.ftc.gov
Last verified against the official page:
How many people
Sonic's own notice didn't give a number. Consumer group Fraud.org, citing reporting at the time, said up to 5 million card numbers may have been compromised across about 3,600 locations, and added that the full extent was unknown. Treat that as a reported estimate, not a confirmed count.
What was exposed
Payment card numbers. That's what a criminal needs to run charges or sell the card to someone who will. Card data isn't the same as identity data: no source describes Social Security numbers or passwords in this incident.
What Sonic did
Sonic offered customers who used a card at its locations that year 24 months of fraud detection and identity theft protection through Experian's IdentityWorks, with enrollment open until December 31, 2017. A class action over the breach later reached a settlement.
What it means for you
If you paid by card at Sonic in 2017, the risk is fraudulent charges, and the fix is quick: check statements and ask your card issuer for a new number if anything looks off.
What to do if you were in it
- 1
Check old card statements
Look at statements from 2017 for charges you don't recognize, and report them to your card issuer right away.
- 2
Ask for a new card number if you're unsure
If you used a card at Sonic in 2017 and still have it, your issuer can replace it. The FTC advises asking for a new number when card details are exposed.
- 3
Watch for messages that mention the breach
Don't click links in emails or texts offering help with it. Go to the company's website yourself.
- 4
Report misuse to the FTC
If someone used your details, report it at IdentityTheft.gov to get a recovery plan.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your details show up, but it can't remove data from a breach.
Official filings
- California Attorney General , filed 5 Oct 2017
Timeline
-
The breach happened
-
The company made it public
-
Reported to the California Attorney General
Frequently asked
Was I affected by the Sonic data breach?
Sonic said cards used at certain Sonic Drive-In locations may have been affected. It didn't publish a list of locations in its notice, so assume risk if you paid by card at Sonic in 2017.
What was exposed?
Credit and debit card numbers, per Sonic's notice. No source describes passwords or Social Security numbers.
Is there a settlement?
Yes. A class action settlement was reached less than two years after the breach. Check the settlement administrator's site for current eligibility and deadlines.
Should I change my password?
Not because of this breach: card numbers were involved, not account passwords. Replace the card if you're unsure it was reissued.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
