MERRIFIELD, Va. (9/25/14)--Nationwide sandwich chain Jimmy John's confirmation Wednesday of a payments-vendor breach that compromised customer information at 216 locations in 39 states is yet another example why the Credit Union National Association and credit unions advocate passing laws making merchants more responsible for such intrusions.
CUNA President/CEO Jim Nussle urged Congress to pursue legislative action that would hold all payment system participants to comparable levels of federal data security requirements.
"Merchant data breaches, regrettably, are becoming a common occurrence because data security standards are inconsistent," Nussle said. "If Congress acts and subjects merchants to the same federal data protection standards to which credit unions and other financial institutions are already subject, that can go a long way to bringing these data breaches to an end."
Eleven percent of Jimmy John's 1,900 franchise locations are affected by the breach, according to information security expert Brian Krebs' website KrebsOnSecurity.com. It reported the incident more than seven weeks ago (KrebsonSecurity Sept. 24).
A press release issued Wednesday by the Champaign, Ill.-based Jimmy John's said the company learned of the incident on July 30 and issued an investigation. Access by the thieves occurred between June 16 and Sept. 5.
Jimmy John's said the incident involved an intruder who stole log-in credentials from its point-of-sale payments processor and used the stolen information to remotely access the point-of-sale systems at some corporate and franchised locations.
KrebsOnSecurity.com reported Wednesday that a number of Jimmy John's stores it contacted use the point-of-sales systems made by Newtown, Pa.-based Signature Systems.
A list of affected locations is on the Jimmy John's website. Use the link to access the press release.
The Jimmy John's confirmation comes on the heels of data breaches at Home Depot and Target. Two credit unions have sued Home Depot over the costs incurred from its breach. (See related story: Two CUs file suit against Home Depot.)