California Pizza Kitchen Data Breach: 100,000+ SSNs Exposed

California Pizza Kitchen Data Breach Exposes Employee Information

California Pizza Kitchen (CPK) recently announced a significant data security incident. The breach resulted in the exposure of Social Security numbers belonging to over 100,000 individuals, encompassing both current and former employees.

Incident Details and Timeline

The U.S.-based pizza chain, operating more than 250 locations across 32 states, publicly disclosed the incident through a data breach notification. CPK initially detected a system “disruption” on September 15th and promptly initiated measures to safeguard its systems.

By October 4th, the investigation revealed that unauthorized cybercriminals had successfully penetrated CPK’s network. These actors gained access to specific files containing sensitive employee data, including names and Social Security numbers.

Scope of the Breach

Although CPK did not initially specify the number of affected individuals, a report from the Maine attorney general’s office detailed the extent of the compromise. A total of 103,767 current and former employees were impacted, with eight of those residing in Maine.

Considering CPK’s workforce of approximately 14,000 employees in 2017, it is likely that a substantial portion of those affected are no longer with the company.

CPK’s Response and Security Measures

California Pizza Kitchen emphasized its commitment to information security, stating that robust security protocols were already in place. Following the discovery of the breach, the company immediately undertook steps to assess and strengthen its computing environment’s security.

CPK is currently reviewing its existing security policies and implementing enhanced safeguards to prevent similar incidents in the future.

Notification Delay

Despite the proactive security measures, questions remain regarding the two-month timeframe between the initial system disruption and notification to state authorities. The company asserts that this delay was not influenced by any law enforcement investigations.

Further Information

• Affected Data: Employee names and Social Security numbers.
• Number of Affected Individuals: Over 100,000 current and former employees.
• Date of Initial Disruption: September 15th.
• Date of Breach Confirmation: October 4th.