The Wendy’s Company

The Wendy’s Company reported a data breach affecting payment card information at some franchisee-operated restaurants in the U.S. The incident occurred between December 2, 2015, and June 8, 2016. The company first reported unusual activity in February 2016. The breach resulted from compromised remote access credentials of a service provider, which allowed attackers to deploy malware on point-of-sale systems. Affected data included cardholder name, credit/debit card number, expiration date, cardholder verification value, and service code. Wendy’s disabled the malware and offered one year of complimentary fraud consultation and identity restoration services to affected customers.