Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

10/3/2018
05:40 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Malware Outbreak Causes Disruptions, Closures at Canadian Restaurant Chain

But Recipe Unlimited denies it was the victim of a ransomware attack, as some have reported.

Recipe Unlimited, a publicly traded company that operates nearly 1,400 restaurants under 19 different brands in Canada, has experienced what appears to be a significant security incident impacting several of its brands.

The company — formerly Cara Operations — on Monday noted that a malware outbreak caused a partial network outage at nine of its franchises. Among those impacted were Swiss Chalet, Harvey's, East Side Mario's, and Kelseys. A "small number" of restaurants have been closed for a "temporary period of time" because of service issues related to the malware, the company said in a statement.

In a report Wednesday, CBC News described Recipe as the victim of a ransomware attack that forced several locations across Canada to temporarily close down this week. CBC posted a copy of a ransom note that it said had been obtained from a worker at one of the affected restaurants, who described all systems at that location as having crashed.

In the ransom note, the hackers claimed to have used the "strongest military algorithms" to encrypt critical company files and were demanding an unspecified amount of money in Bitcoin, CBC said.

"The final price depends on how fast you write to us," the purported ransom note said. "Every day of delay will cost you additional +0.5 BTC."

Dark Reading was unable to independently verify CBC's report that ransomware was the cause for the network disruptions at Recipe. The company did not immediately respond to an inquiry seeking a status update and information on how many restaurants might have been impacted, how many locations were forced to temporarily close down, and whether, in fact, ransomware was the cause.

Recipe's statement merely noted that the company discovered the malware outbreak Sept. 28 and took immediate steps to mitigate damage. A number of systems have been taken offline, and Internet access has been suspended to all of the affected locations.

The measures have caused service delays at some locations, leaving them unable to accept payment card transactions. However, those locations are continuing to process card transactions manually, Recipe said. "A smaller number of affected restaurants have decided to close for a temporary period of time to avoid inconvenience to guests due to service issues," it added.

CBS quoted a Recipe spokeswoman as denying the incident was ransomware-related. The ransom note that the worker purportedly provided to CBS was also just a generic statement associated with malware named Ryuk that surfaced earlier this year, the spokeswoman reportedly said.

If Recipe, in fact, was the victim of a ransomware attack, it certainly wouldn't be surprising. Security vendor RiskIQ recently estimated that 90 organizations fall victim to ransomware every hour. Just one example is the Port of San Diego, which last week experienced major network disruptions related to a ransomware attack. Over the course of this year, numerous others have been similarly hit, including Boeing, the City of Atlanta, the Colorado Department of Transportation, and the Erie County Medical Center.

RiskIQ estimates the average cost to businesses from such attacks at around $15,220. But some victims end up paying many magnitudes more. Erie County Medical Center, for instance, estimated it spent $10 million on recovering from its ransomware attack; the City of Atlanta pegged its costs at $5 million on emergency IT services alone, and Colorado's DoT spent more than $1.5 million.

Related Content:

 

Black Hat Europe returns to London Dec 3-6 2018  with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
10 Ways to Keep a Rogue RasPi From Wrecking Your Network
Curtis Franklin Jr., Senior Editor at Dark Reading,  7/10/2019
The Security of Cloud Applications
Hillel Solow, CTO and Co-founder, Protego,  7/11/2019
Where Businesses Waste Endpoint Security Budgets
Kelly Sheridan, Staff Editor, Dark Reading,  7/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "Jim, stop pretending you're drowning in tickets."
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-13623
PUBLISHED: 2019-07-17
In NSA Ghidra through 9.0.4, path traversal can occur in RestoreTask.java (from the package ghidra.app.plugin.core.archive) via an archive with an executable file that has an initial ../ in its filename. This allows attackers to overwrite arbitrary files in scenarios where an intermediate analysis r...
CVE-2019-13624
PUBLISHED: 2019-07-17
In ONOS 1.15.0, apps/yang/web/src/main/java/org/onosproject/yang/web/YangWebResource.java mishandles backquote characters within strings that can be used in a shell command.
CVE-2019-13625
PUBLISHED: 2019-07-17
NSA Ghidra before 9.0.1 allows XXE when a project is opened or restored, or a tool is imported, as demonstrated by a project.prp file.
CVE-2019-3571
PUBLISHED: 2019-07-16
An input validation issue affected WhatsApp Desktop versions prior to 0.3.3793 which allows malicious clients to send files to users that would be displayed with a wrong extension.
CVE-2019-6160
PUBLISHED: 2019-07-16
A vulnerability in various versions of Iomega and LenovoEMC NAS products could allow an unauthenticated user to access files on NAS shares via the API.