Data breach affects 3 area Jimmy John’s

Three area locations of Jimmy John’s Gourmet Sandwiches were among the eight in Colorado and 216 nationwide that were affected by a recent data breach, according to a statement posted Wednesday on the company’s website.

Credit- and debit-card transactions were affected from June 16 to July 25 at the store at 210 Ken Pratt Blvd., Suite 200, in Longmont; from July 1 to Aug. 1 at 625 Flatiron Marketplace Drive in Broomfield; and from July 7 to Aug. 1 at 2644 11th Ave., Suite B, in Greeley.

In the statement, the Champaign, Ill.-based chain said it learned of the breach on July 30, and it was made public the next day on data-security blog KrebsOnSecurity. The chain hired third-party forensic experts to aid in its investigation.

SPONSORED CONTENT

How Platte River Power Authority is accelerating its energy transition

Platte River Power Authority, the community-owned wholesale electricity provider for Northern Colorado, has a history of bold initiatives.

“While the investigation is ongoing, it appears that customers’ credit and debit card data was compromised after an intruder stole log-in credentials from Jimmy John’s point-of-sale vendor and used these stolen credentials to remotely access the point-of-sale systems at some corporate and franchised locations” between June 16 and Sept. 5, the statement said. “The security compromise has been contained, and customers can use their credit and debit cards securely at Jimmy John’s stores.”

Customers’ affected cards “appear to be those swiped at the stores, and did not include those cards entered manually or online,” the statement said. “The credit and debit card information at issue may include the card number and in some cases the cardholder’s name, verification code, and/or the card’s expiration date. Information entered online, such as customer address, email and password, remains secure.”

The company apologized to customers in the statement, and said it “has taken steps to prevent this type of event from occurring in the future, including installing encrypted swipe machines, implementing system enhancements and reviewing its policies and procedures for its third-party vendors.”

Jimmy John’s said it is offering identity-protection services to any customers who were affected by the data breach; they can call 855-398-6442 for more information.

Nineteen-year-old Jimmy John Liautaud, who had just graduated second from last in his high school class, used a loan from his father to open his first restaurant in 1983 in a garage in Charleston, Ill. He still serves as chief executive of the company, which has grown to more than 2,000 locations in 43 states. About 98 percent of the shops are franchise-owned.