Landry’s Restaurant Chain Suffers Payment Card Theft Via PoS Malware

Landry’s, a popular restaurant chain in the United States, has announced a malware attack on its point of sale (POS) systems that allowed cybercriminals to steal customers’ payment card information.

Landry’s owns and operates more than 600 bars, restaurants, hotels, casinos, food and beverage outlets with over 60 different brands such as Landry’s Seafood, Chart House, Saltgrass Steak House, Claim Jumper, Morton’s The Steakhouse, Mastro’s Restaurants, and Rainforest Cafe.

According to the breach notification published this week, the malware was designed to search for and likely steal sensitive customer credit card data, including credit card numbers, expiration dates, verification codes and, in some cases, cardholder names.

The PoS malware infected point-of-sale terminals at all Landry’s owned locations, but, fortunately, due to end-to-end encryption technology used by the company, attackers failed to steal payment card data from cards swiped at its restaurants.

However, Landry’s outlets also use “order-entry systems with a card reader attached for waitstaff to enter kitchen and bar orders and to swipe Landry’s Select Club reward cards,” which allowed attackers to successfully steal customers’ payment data “in rare circumstances” when waitstaff mistakenly swiped payment cards on them.

The restaurant chain did not speculate how many customers may have been affected, but it is “notifying customers” that “in rare circumstances, appear to have been mistakenly swiped by waitstaff on devices used to enter kitchen and bar orders, which are different devices than the point-of-sale terminals used for payment processing,” the breach notification says.

“The malware searched for track data (which sometimes has the cardholder name in addition to card number, expiration date, and internal verification code) read from a payment card after it was swiped on the order-entry systems. In some instances, the malware only identified the part of the magnetic stripe that contained payment card information without the cardholder name.”

According to the company, the POS malware was actively scanning their systems between 13th March 2019 and 17th October 2019 for swipe cards; and at some locations, it may have been installed as early as 18th January 2019.

“During the investigation, we removed the malware and implemented enhanced security measures, and we are providing additional training to waitstaff.”

So, if you have used your debit or credit card at any of the above listed outlet last year, you are advised to stay vigilant, monitor your payment card statements for any suspicious activity and immediately report it to your bank and local law enforcement, if found.