Millions of KFC loyalty scheme members may have their passwords sold online after major hack

Members of the Colonel's Club loyalty scheme in the UK were targeted
All 1.2 million members have now been advised to change password
Experts say that hackers are banking on people using the same password on multiple sites, allowing them to be targeted in a range of ways

Published: 15:48 GMT, 13 December 2016 | Updated: 17:42 GMT, 13 December 2016

e-mail

View
comments

KFC, best known for its 'finger lickin' good' chicken, has had its website hacked, leaving millions of people vulnerable.

In an email to its Colonel's Club loyalty scheme members, KFC said that a 'small number' of accounts 'may have been compromised.'

While the hack may affect members' ability to buy chicken, it could also leave them vulnerable to subsequent attacks, should they use the same password on other sites.

KFC, the popular food chain best known for it's 'finger lickin' good' chicken, has had its website hacked, leaving millions of people vulnerable

PASSWORD RE-USE ATTACKS

While KFC might not seem like an obvious firm for an attack, hackers are taking advantage of the fact that many users use similar passwords across multiple sites.

Password re-use is one of the biggest concerns facing online accounts today, but this issue could be overcome by using unique password on each website, or using a password manager.

Mark James, an IT security specialist at ESET, told MailOnline: 'Quite often we don't value all websites with the same level of security, duplicating passwords on what we assume is a low security website could enable hackers to get your details and try those on your very important logins like financial or shopping websites with success.

'It's very difficult to remember our details for every site we log in too, almost everything we do on the internet requires us to create an account and store more details on servers that we have no control over their level of security.

'The only thing we can control is the usefulness of the data we provide, keeping it unique or managed is the only way forward in today's digital world.'

KFC's Colonel's Club loyalty scheme currently has 1.2 million users in the UK, who can collect points to earn free food rewards.

All 1.2 million users were sent an email, advising them to change their passwords, although only a 'small number' had been hacked.

The email also advised customers who use the same email address and password for other sites to reset them 'to be safe'.

KFC told ITV News that around 30 members had been targeted, but that all customers had been informed.

Brad Scheiner, Head of IT at KFC UK & Ireland said: 'We take the online security of our fans very seriously, so we've advised all Colonel's Club members to change their passwords as a precaution, despite only a small number of accounts being directly affected.

'We don't store credit card details as part of our Colonel's Club rewards scheme, so no financial data was compromised.'

While KFC might not seem like an obvious firm for an attack, hackers are taking advantage of the fact that many users use similar passwords across multiple sites.

Javvad Malik, Security Advocate at AlienVault told MailOnline: 'Given the relatively small number of accounts that have been targeted, it appears as if password re-use could have been the attack vector.

'Companies running loyalty or gift card schemes should not consider themselves to be small targets, regardless of whether there are financial systems linked.

'We are repeatedly seeing that attackers are indiscriminate against the size of company or the data they hold.'

All 1.2 million users were sent an email, advising them to change their passwords, although only a 'small number' had been hacked

Password re-use is one of the biggest concerns facing online accounts today, but this issue could be overcome by using unique password on each website, or using a password manager.

'It's very difficult to remember our details for every site we log into, almost everything we do on the internet requires us to create an account and store more details on servers that we have no control over their level of security.