What cyber risks do restaurants face?

Feeling famished after a long day, you walk into your favourite takeout restaurant to order dinner. You place your order, and the restaurant’s Wi-Fi enabled Point of Sale (POS) system sends it directly to the kitchen and processes your payment.

Behind the scenes, the cloud-based POS system manages reservations, inventory, food usage, loyalty programs, table service, online ordering, pickup, delivery, and payroll.

With such heavy reliance on cloud-enabled operations, it’s no surprise that 46 percent of restaurant and foodservices cyber losses are caused by malware and hacking1.

The top 3 patterns for cyber breaches to the foodservices and hospitality industry are point of sale intrusions, web applications and crimeware1.

1. Example of a point of sale intrusion

In February 2019 a restaurant chain’s POS system was compromised by hackers, who deployed malware through its third-party POS vendor. The malware was designed to collect the personal and financial data of customers, such as name, credit / debit card number, expiration date and CVV. The company responded by engaging an IT security and forensics firm to contain the event and restore systems. It then proceeded to notify its customers of the incident, advising them to monitor transactions and credit reports for suspicious activity.

It’s not only chains that are being targeted. POS intrusions often target small businesses1.

2. Web application breach

Most restaurants process takeout and delivery orders through their own web app. Payment card web app compromises are well on their way to exceeding physical terminal compromises in payment card-related breaches2.

In web application compromises, attackers scan specific vulnerabilities, gain access, insert malware and harvest payment card data for profit.

3. What is crimeware?

Crimeware is a class of malware designed to automate cybercrime.

Hackers exploit insecure remote access software, deficient networks, and weak user credentials, with the intent to gain access to POS systems, to collect, steal, and monetize data.

Learn more about BI&I’s Data Compromise and CyberOne® coverages and services designed for restaurant clients, or contact your BI&I representative.


1 Verizon, Data Breaches in Accommodation and Food Service Industries, 2019.
2 Verizon, 2019 Data Breach Investigations Report

© The Boiler Inspection and Insurance Company of Canada (BI&I). All rights reserved. This article is for informational purposes only and is not intended to convey or constitute legal advice. BI&I makes no warranties or representations as to the accuracy or completeness of the content herein. Under no circumstances shall BI&I or any party involved in creating or delivering this article be liable to you for any loss or damage that results from the use of the information contained herein. Except as otherwise expressly permitted by BI&I in writing, no portion of this article may be reproduced, copied, or distributed in any way. This article does not modify or invalidate any of the provisions, exclusions, terms or conditions of the applicable policy and endorsements. For specific terms and conditions, please refer to the applicable insurance form.