Houston, Texas-based dining, hospitality and gaming company Landry’s revealed recently that it had discovered a piece of malware designed to steal payment card information on its systems.
Following a payment card breach that hit the company’s restaurants in 2015, Landry’s started using a payment processing solution that relies on end-to-end encryption to protect sensitive information on point-of-sale (PoS) terminals. The company started rolling out the new system in 2016 and it’s currently used at all of its locations.
Last year, cybercriminals managed to plant a piece of malware on Landry’s systems in hopes of stealing payment card information. However, the company says the encryption technology prevented the malware from obtaining any information from PoS systems.
However, in what the company has described as “rare circumstances,” waitstaff mistakenly swiped customer cards on order-entry systems. These systems, used by staff to enter bar and kitchen orders and to swipe reward cards, also have a card reader.
The problem is that the order-entry systems are not protected by the same end-to-end encryption technology as PoS terminals and Landry’s says the malware may have captured data from payment cards mistakenly swiped by staff on order-entry systems.
“The malware searched for track data (which sometimes has the cardholder name in addition to card number, expiration date, and internal verification code) read from a payment card after it was swiped on the order-entry systems. In some instances, the malware only identified the part of the magnetic stripe that contained payment card information without the cardholder name,” the company told customers.
Based on its investigation, Landry’s believes the malware may have stolen data from cards swiped between March 13 and October 17, 2019, but in a small number of cases the malware may have been present since January 18, 2019.
Landry’s has listed 63 of its brands as being affected, but the actual number of potentially impacted locations is higher as some brands are present in more than one city in the United States.
Landry’s joins a long list of restaurant companies that disclosed payment card breaches over the past year, including Islands Restaurants, On The Border, Church’s Chicken, Catch, Focus Brands (Moe’s, McAlister’s and Schlotzsky’s), Checkers Drive-In Restaurants, Earl Enterprises, Huddle House, Chili’s, Applebee’s, and Cheddar’s Scratch Kitchen.