Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

10/3/2018
05:40 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Malware Outbreak Causes Disruptions, Closures at Canadian Restaurant Chain

But Recipe Unlimited denies it was the victim of a ransomware attack, as some have reported.

Recipe Unlimited, a publicly traded company that operates nearly 1,400 restaurants under 19 different brands in Canada, has experienced what appears to be a significant security incident impacting several of its brands.

The company — formerly Cara Operations — on Monday noted that a malware outbreak caused a partial network outage at nine of its franchises. Among those impacted were Swiss Chalet, Harvey's, East Side Mario's, and Kelseys. A "small number" of restaurants have been closed for a "temporary period of time" because of service issues related to the malware, the company said in a statement.

In a report Wednesday, CBC News described Recipe as the victim of a ransomware attack that forced several locations across Canada to temporarily close down this week. CBC posted a copy of a ransom note that it said had been obtained from a worker at one of the affected restaurants, who described all systems at that location as having crashed.

In the ransom note, the hackers claimed to have used the "strongest military algorithms" to encrypt critical company files and were demanding an unspecified amount of money in Bitcoin, CBC said.

"The final price depends on how fast you write to us," the purported ransom note said. "Every day of delay will cost you additional +0.5 BTC."

Dark Reading was unable to independently verify CBC's report that ransomware was the cause for the network disruptions at Recipe. The company did not immediately respond to an inquiry seeking a status update and information on how many restaurants might have been impacted, how many locations were forced to temporarily close down, and whether, in fact, ransomware was the cause.

Recipe's statement merely noted that the company discovered the malware outbreak Sept. 28 and took immediate steps to mitigate damage. A number of systems have been taken offline, and Internet access has been suspended to all of the affected locations.

The measures have caused service delays at some locations, leaving them unable to accept payment card transactions. However, those locations are continuing to process card transactions manually, Recipe said. "A smaller number of affected restaurants have decided to close for a temporary period of time to avoid inconvenience to guests due to service issues," it added.

CBS quoted a Recipe spokeswoman as denying the incident was ransomware-related. The ransom note that the worker purportedly provided to CBS was also just a generic statement associated with malware named Ryuk that surfaced earlier this year, the spokeswoman reportedly said.

If Recipe, in fact, was the victim of a ransomware attack, it certainly wouldn't be surprising. Security vendor RiskIQ recently estimated that 90 organizations fall victim to ransomware every hour. Just one example is the Port of San Diego, which last week experienced major network disruptions related to a ransomware attack. Over the course of this year, numerous others have been similarly hit, including Boeing, the City of Atlanta, the Colorado Department of Transportation, and the Erie County Medical Center.

RiskIQ estimates the average cost to businesses from such attacks at around $15,220. But some victims end up paying many magnitudes more. Erie County Medical Center, for instance, estimated it spent $10 million on recovering from its ransomware attack; the City of Atlanta pegged its costs at $5 million on emergency IT services alone, and Colorado's DoT spent more than $1.5 million.

Related Content:

 

Black Hat Europe returns to London Dec 3-6 2018  with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
7 Tips for Infosec Pros Considering A Lateral Career Move
Kelly Sheridan, Staff Editor, Dark Reading,  1/21/2020
For Mismanaged SOCs, The Price Is Not Right
Kelly Sheridan, Staff Editor, Dark Reading,  1/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
IT 2020: A Look Ahead
Are you ready for the critical changes that will occur in 2020? We've compiled editor insights from the best of our network (Dark Reading, Data Center Knowledge, InformationWeek, ITPro Today and Network Computing) to deliver to you a look at the trends, technologies, and threats that are emerging in the coming year. Download it today!
Flash Poll
How Enterprises are Attacking the Cybersecurity Problem
How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-3154
PUBLISHED: 2020-01-27
CRLF injection vulnerability in Zend\Mail (Zend_Mail) in Zend Framework before 1.12.12, 2.x before 2.3.8, and 2.4.x before 2.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the header of an email.
CVE-2019-17190
PUBLISHED: 2020-01-27
A Local Privilege Escalation issue was discovered in Avast Secure Browser 76.0.1659.101. The vulnerability is due to an insecure ACL set by the AvastBrowserUpdate.exe (which is running as NT AUTHORITY\SYSTEM) when AvastSecureBrowser.exe checks for new updates. When the update check is triggered, the...
CVE-2014-8161
PUBLISHED: 2020-01-27
PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to obtain sensitive column values by triggering constraint violation and then reading the error message.
CVE-2014-9481
PUBLISHED: 2020-01-27
The Scribunto extension for MediaWiki allows remote attackers to obtain the rollback token and possibly other sensitive information via a crafted module, related to unstripping special page HTML.
CVE-2015-0241
PUBLISHED: 2020-01-27
The to_char function in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to cause a denial of service (crash) or possibly execute arbitrary code via a (1) large number of digits when processing a numeric ...