https://www.theverge.com/2018/8/1/17639914/carbanak-indictment-hacking-credit-card-records-ukraine-campaign-chipotle-chilis-arbys

Three Ukranian nationals have been arrested in connection with a lengthy hacking campaign that targeted more than 100 American businesses, including the theft of credit card information from Chili’s, Arby’s, and Chipotle. According to the indictment, the group stole more than 15 million credit card records from more than 6,500 point-of-sale terminals over the course of the campaign.

Known to security researchers as the Carbanak group, the group used social engineering and phishing attacks to infiltrate businesses and steal financial data. The initial infection typically came from malware included as an email attachment, sometimes presented as a lost hotel reservation or an SEC complaint.