Landry’s Restaurant Chain Suffers Payment Card Theft Via PoS Malware

Landry’s, a popular restaurant chain in the United States, has
announced a malware attack on its point of sale (POS) systems that
allowed cybercriminals to steal customers’ payment card
information.

Landry’s owns and operates more than 600 bars, restaurants,
hotels, casinos, food and beverage outlets with over 60 different
brands such as Landry’s Seafood, Chart House, Saltgrass Steak
House, Claim Jumper, Morton’s The Steakhouse, Mastro’s Restaurants,
and Rainforest Cafe.

According to the breach notification
published this week, the malware was designed to search for and
likely steal sensitive customer credit card data, including credit
card numbers, expiration dates, verification codes and, in some
cases, cardholder names.
^[1]

The PoS malware infected point-of-sale terminals at all Landry’s
owned locations, but, fortunately, due to end-to-end encryption
technology used by the company, attackers failed to steal payment
card data from cards swiped at its restaurants.

However, Landry’s outlets also use “order-entry systems with a
card reader attached for waitstaff to enter kitchen and bar orders
and to swipe Landry’s Select Club reward cards,” which allowed
attackers to successfully steal customers’ payment data “in rare
circumstances” when waitstaff mistakenly swiped payment cards on
them.

The restaurant chain did not speculate how many customers may have
been affected, but it is “notifying customers” that “in rare
circumstances, appear to have been mistakenly swiped by waitstaff
on devices used to enter kitchen and bar orders, which are
different devices than the point-of-sale terminals used for payment
processing,” the breach notification says.

“The malware searched for track data (which sometimes has the
cardholder name in addition to card number, expiration date, and
internal verification code) read from a payment card after it was
swiped on the order-entry systems. In some instances, the malware
only identified the part of the magnetic stripe that contained
payment card information without the cardholder name.”

According to the company, the POS malware was actively scanning
their systems between 13th March 2019 and 17th October 2019 for
swipe cards; and at some locations, it may have been installed as
early as 18th January 2019.

“During the investigation, we removed the malware and
implemented enhanced security measures, and we are providing
additional training to waitstaff.”

So, if you have used your debit or credit card at any of the
above listed outlet last year, you are advised to stay vigilant,
monitor your payment card statements for any suspicious
activity and immediately report it to your bank and local law
enforcement, if found.