Attacks/Breaches

10/3/2018
05:40 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Malware Outbreak Causes Disruptions, Closures at Canadian Restaurant Chain

But Recipe Unlimited denies it was the victim of a ransomware attack, as some have reported.

Recipe Unlimited, a publicly traded company that operates nearly 1,400 restaurants under 19 different brands in Canada, has experienced what appears to be a significant security incident impacting several of its brands.

The company — formerly Cara Operations — on Monday noted that a malware outbreak caused a partial network outage at nine of its franchises. Among those impacted were Swiss Chalet, Harvey's, East Side Mario's, and Kelseys. A "small number" of restaurants have been closed for a "temporary period of time" because of service issues related to the malware, the company said in a statement.

In a report Wednesday, CBC News described Recipe as the victim of a ransomware attack that forced several locations across Canada to temporarily close down this week. CBC posted a copy of a ransom note that it said had been obtained from a worker at one of the affected restaurants, who described all systems at that location as having crashed.

In the ransom note, the hackers claimed to have used the "strongest military algorithms" to encrypt critical company files and were demanding an unspecified amount of money in Bitcoin, CBC said.

"The final price depends on how fast you write to us," the purported ransom note said. "Every day of delay will cost you additional +0.5 BTC."

Dark Reading was unable to independently verify CBC's report that ransomware was the cause for the network disruptions at Recipe. The company did not immediately respond to an inquiry seeking a status update and information on how many restaurants might have been impacted, how many locations were forced to temporarily close down, and whether, in fact, ransomware was the cause.

Recipe's statement merely noted that the company discovered the malware outbreak Sept. 28 and took immediate steps to mitigate damage. A number of systems have been taken offline, and Internet access has been suspended to all of the affected locations.

The measures have caused service delays at some locations, leaving them unable to accept payment card transactions. However, those locations are continuing to process card transactions manually, Recipe said. "A smaller number of affected restaurants have decided to close for a temporary period of time to avoid inconvenience to guests due to service issues," it added.

CBS quoted a Recipe spokeswoman as denying the incident was ransomware-related. The ransom note that the worker purportedly provided to CBS was also just a generic statement associated with malware named Ryuk that surfaced earlier this year, the spokeswoman reportedly said.

If Recipe, in fact, was the victim of a ransomware attack, it certainly wouldn't be surprising. Security vendor RiskIQ recently estimated that 90 organizations fall victim to ransomware every hour. Just one example is the Port of San Diego, which last week experienced major network disruptions related to a ransomware attack. Over the course of this year, numerous others have been similarly hit, including Boeing, the City of Atlanta, the Colorado Department of Transportation, and the Erie County Medical Center.

RiskIQ estimates the average cost to businesses from such attacks at around $15,220. But some victims end up paying many magnitudes more. Erie County Medical Center, for instance, estimated it spent $10 million on recovering from its ransomware attack; the City of Atlanta pegged its costs at $5 million on emergency IT services alone, and Colorado's DoT spent more than $1.5 million.

Related Content:

 

Black Hat Europe returns to London Dec 3-6 2018  with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Making the Case for a Cybersecurity Moon Shot
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  2/19/2019
New Free Tool Scans for Chrome Extension Safety
Dark Reading Staff 2/21/2019
Privacy Ops: The New Nexus for CISOs & DPOs
Amit Ashbel, Security Evangelist, Cognigo,  2/18/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
How Enterprises Are Attacking the Cybersecurity Problem
How Enterprises Are Attacking the Cybersecurity Problem
Data breach fears and the need to comply with regulations such as GDPR are two major drivers increased spending on security products and technologies. But other factors are contributing to the trend as well. Find out more about how enterprises are attacking the cybersecurity problem by reading our report today.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-8955
PUBLISHED: 2019-02-21
In Tor before 0.3.3.12, 0.3.4.x before 0.3.4.11, 0.3.5.x before 0.3.5.8, and 0.4.x before 0.4.0.2-alpha, remote denial of service against Tor clients and relays can occur via memory exhaustion in the KIST cell scheduler.
CVE-2019-1698
PUBLISHED: 2019-02-21
A vulnerability in the web-based user interface of Cisco Internet of Things Field Network Director (IoT-FND) Software could allow an authenticated, remote attacker to gain read access to information that is stored on an affected system. The vulnerability is due to improper handling of XML External E...
CVE-2019-1700
PUBLISHED: 2019-02-21
A vulnerability in field-programmable gate array (FPGA) ingress buffer management for the Cisco Firepower 9000 Series with the Cisco Firepower 2-port 100G double-width network module (PID: FPR9K-DNM-2X100G) could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) conditio...
CVE-2019-6340
PUBLISHED: 2019-02-21
Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RE...
CVE-2019-8996
PUBLISHED: 2019-02-21
In Signiant Manager+Agents before 13.5, the implementation of the set command has a Buffer Overflow.