Restaurant customer management platform SevenRooms has confirmed it suffered a data breach after a threat actor began selling stolen data on a hacking forum.
SevenRooms is a restaurant customer relationship management (CRM) platform used by international restaurant chains and hospitality service providers, such as MGM Resorts, Bloomin’ Brands, Mandarin Oriental, Wolfgang Puck, and many more.
On December 15, a threat actor posted data samples on the Breached hacking forum, claiming to have stolen a 427 GB backup database with thousands of files containing information about SevenRooms customers.
The samples provided by the seller include folders named after big restaurant chains, clients of SevenRooms, API keys, promo codes, payment reports, reservation lists, and more.
Source: BleepingComputer
After BleepingComptuer contacted SevenRooms about the data being sold online, they confirmed that it was their data was caused by unauthorized access to the systems of one of its vendors.
“SevenRooms recently learned that a file transfer interface of a third-party vendor was accessed without authorization,” a SevebRooms spokesperson told BleepingComputer.
“This may have affected certain documents transferred to or by SevenRooms, including the exchange of API credentials (now expired), and some guest data, which may include names, email addresses and phone numbers” – SevenRooms.
The company clarified that guests’ credit card information, bank account data, social security numbers, or any other similarly highly sensitive information was not stored on compromised servers, so it was not exposed in the attack.
Furthermore, SevenRooms claims that there has been no direct breach of its systems, which remain secure against unauthorized external access.
“We immediately disabled access to the interface, launched an internal investigation, and we currently have no evidence that any of SevenRooms’ proprietary databases were affected,” stated the spokesperson.
“We have retained independent cybersecurity experts to assist with this investigation and will provide additional updates as appropriate.”
SevenRooms states that they have hired an independent cybersecurity company to aid in the investigation of the incident and will provide further updates as more information becomes available.
While it is unclear what restaurants and customers were affected by this breach, we will likely see further data breach notifications released by restaurants whose customers’ data was exposed.
