Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Incident Response

Catch Restaurants Hit by Point-of-Sale Malware

Catch Hospitality Group alerted its restaurant customers that cybercriminals managed to infect some of its point-of-sale (“PoS”) devices with credit card data scraping malware.

Catch Hospitality Group alerted its restaurant customers that cybercriminals managed to infect some of its point-of-sale (“PoS”) devices with credit card data scraping malware.

The company is notifying customers of Catch NYC (including Catch Roof) and Catch Steak about the incident, informing them that the discovered malware was designed to search for track data (such as cardholder name, card number, expiration date, and internal verification code) on its PoS devices.

According to Catch, however, the impact appears to be limited, as the malware was found on only one of the two different PoS devices used at Catch NYC and Catch Steak. 

Specifically, one of the devices is brought to the tables and used for almost all of the dining area transactions, and the other is at the bar and areas where the dining area waitstaff enter orders for the kitchen. 

The company claims that only cards used at the bar or where waitstaff enter orders were impacted by this attack, as the transactions on PoS devices that are brought to tables are secured via point-to-point encryption technology. 

Catch also explained that the timeframes when payment card data may have been accessed varies between the two locations. Catch NYC (including Catch Roof) was infected between March 19, 2019 and October 17, 2019, while Catch Steak was infected between September 17, 2019 and October 17, 2019.

The company says it has already removed the malware and added extra security measures to its systems, while also looking into more ways to improve the security of payment card data.

The incident was also reported to the payment processor and law enforcement is conducting an investigation. 

Advertisement. Scroll to continue reading.

“It is always advisable to review your payment card statements for any unauthorized activity. You should immediately report any unauthorized charges to your card issuer because payment card rules generally provide that cardholders are not responsible for unauthorized charges reported in a timely manner,” Catch notes. 

Related: Order Information of OnePlus Customers Exposed in Data Breach

Related: Magecart Attack on eCommerce Platform Hits Thousands of Online Shops

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.

Register

SecurityWeek’s Ransomware Resilience and Recovery Summit helps businesses to plan, prepare, and recover from a ransomware incident.

Register

Expert Insights

Related Content

Cybercrime

A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...

Data Breaches

LastPass DevOp engineer's home computer hacked and implanted with keylogging malware as part of a sustained cyberattack that exfiltrated corporate data from the cloud...

Incident Response

Microsoft has rolled out a preview version of Security Copilot, a ChatGPT-powered tool to help organizations automate cybersecurity tasks.

Data Breaches

GoTo said an unidentified threat actor stole encrypted backups and an encryption key for a portion of that data during a 2022 breach.

Application Security

GitHub this week announced the revocation of three certificates used for the GitHub Desktop and Atom applications.

Incident Response

Meta has developed a ten-phase cyber kill chain model that it believes will be more inclusive and more effective than the existing range of...

Cloud Security

VMware described the bug as an out-of-bounds write issue in its implementation of the DCE/RPC protocol. CVSS severity score of 9.8/10.