Security Experts:

Connect with us

Hi, what are you looking for?


Incident Response

Catch Restaurants Hit by Point-of-Sale Malware

Catch Hospitality Group alerted its restaurant customers that cybercriminals managed to infect some of its point-of-sale (“PoS”) devices with credit card data scraping malware.

Catch Hospitality Group alerted its restaurant customers that cybercriminals managed to infect some of its point-of-sale (“PoS”) devices with credit card data scraping malware.

The company is notifying customers of Catch NYC (including Catch Roof) and Catch Steak about the incident, informing them that the discovered malware was designed to search for track data (such as cardholder name, card number, expiration date, and internal verification code) on its PoS devices.

According to Catch, however, the impact appears to be limited, as the malware was found on only one of the two different PoS devices used at Catch NYC and Catch Steak. 

Specifically, one of the devices is brought to the tables and used for almost all of the dining area transactions, and the other is at the bar and areas where the dining area waitstaff enter orders for the kitchen. 

The company claims that only cards used at the bar or where waitstaff enter orders were impacted by this attack, as the transactions on PoS devices that are brought to tables are secured via point-to-point encryption technology. 

Catch also explained that the timeframes when payment card data may have been accessed varies between the two locations. Catch NYC (including Catch Roof) was infected between March 19, 2019 and October 17, 2019, while Catch Steak was infected between September 17, 2019 and October 17, 2019.

The company says it has already removed the malware and added extra security measures to its systems, while also looking into more ways to improve the security of payment card data.

The incident was also reported to the payment processor and law enforcement is conducting an investigation. 

“It is always advisable to review your payment card statements for any unauthorized activity. You should immediately report any unauthorized charges to your card issuer because payment card rules generally provide that cardholders are not responsible for unauthorized charges reported in a timely manner,” Catch notes. 

Related: Order Information of OnePlus Customers Exposed in Data Breach

Related: Magecart Attack on eCommerce Platform Hits Thousands of Online Shops

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Expert Insights

Related Content

Data Breaches

GoTo said an unidentified threat actor stole encrypted backups and an encryption key for a portion of that data during a 2022 breach.


A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...

Incident Response

Cygnvs emerges from stealth mode with an incident response platform and $55 million in Series A funding.

Application Security

GitHub this week announced the revocation of three certificates used for the GitHub Desktop and Atom applications.

Data Breaches

T-Mobile disclosed another massive data breach affecting approximately 37 million customer accounts.

Incident Response

A new Mississippi Cyber Unit will be the state’s centralized cybersecurity threat information, mitigation and incident reporting and response center.


Albanian prosecutors on Wednesday asked for the house arrest of five public employees they blame for not protecting the country from a cyberattack by...


Thoma Bravo will spend $1.3 billion to acquire Canadian software firm Magnet Forensics, expanding a push into the lucrative cybersecurity business.