Panera Bread, the renowned American fast-food chain, is suspected to have paid a ransom following a ransomware attack that compromised its systems in March. This inference comes from language used in an internal email sent to employees, indicating the company may have negotiated with the attackers to secure the deletion of stolen data.
Last week, Panera Bread began notifying its employees about the data breach, informing them that the attack had resulted in the theft of personal information, including names and social security numbers.
Despite the lack of a public statement from Panera detailing the breach, initial reports from cybersecurity news outlet BleepingComputer revealed that the attack had encrypted all of Panera’s virtual machines, leading to significant operational disruptions.
The breach resulted in a week-long disruption across Panera’s digital and operational platforms, affecting their website, phone systems, mobile app, point-of-sale, and internal systems. Fortunately, BleepingComputer later reported that one of Panera’s storage servers remained unencrypted, enabling the company to restore its systems from backups.
Intriguingly, no ransomware group has claimed responsibility for the attack, nor has any stolen data surfaced online. This silence from the usual perpetrators suggests that a ransom may have been paid to prevent the release of the stolen data.
Just as the data breach notifications were being sent out last Thursday, a Reddit post from an alleged Panera employee claimed that the company had indeed paid a ransom to ensure the hackers deleted the stolen data.
“This probably will not make it far but just got out of a corporate meeting where they broke to us that all our data has been stolen since March and they paid the hackers to ‘not release’ its employees’ data,” the anonymous Reddit user wrote.
They also shared a snippet from an internal email sent by Senior Vice President KJ Payette, which corroborated the ransom payment claim. The email stated, “Please note that we obtained assurances that the information involved was deleted and will not be published. As of now, there is no indication that the information accessed has been made publicly available.”
Ransomware attacks typically involve threat actors breaching a company’s network, quietly spreading throughout to steal sensitive data before deploying encryption software to lock the company out of its own systems. The attackers then use the stolen data and the encrypted files as leverage to demand a ransom, promising to provide a decryptor and delete any stolen data upon payment.
The assurances mentioned in the internal email imply that such negotiations took place and that a ransom was paid to obtain these promises. However, cybersecurity experts warn that paying a ransom does not guarantee the complete deletion of the stolen data.
There have been numerous instances where threat actors did not honor their commitments, choosing instead to sell the data to other cybercriminals, leak it on data breach sites, or use it to further extort the victim company.
A recent example of this troubling trend is the BlackCat ransomware attack on United Healthcare. The company paid a $22 million ransom to get a decryptor and secure a promise that the stolen data would be deleted.
Nevertheless, the affiliate behind the attack claimed they never received their share of the ransom and subsequently threatened to sell the data unless another payment was made. To demonstrate they still had the data, the attackers leaked samples on a different ransomware group’s data leak site, Ransom Hub.
The eventual disappearance of United Healthcare’s data from this site suggested another ransom might have been paid.
Given these risks, ransomware negotiators and cybersecurity experts generally advise against paying ransoms for data deletion. They argue that there is no assurance the data will be erased, and the payment can often encourage further extortion.
Despite attempts to reach out, Panera Bread has not confirmed whether it paid a ransom. The company remains silent on the matter, leaving employees and the public in suspense about the true extent and resolution of the attack.
This incident highlights the ongoing vulnerability of major corporations to sophisticated ransomware attacks and underscores the critical importance of robust cybersecurity measures to protect sensitive data from cybercriminals.
As ransomware attacks continue to rise, companies must remain vigilant and prepared to respond effectively to such threats to safeguard their operations and the personal information of their employees and customers.