Malware Outbreak Causes Disruptions, Closures at Canadian Restaurant Chain

Recipe Unlimited, a publicly traded company that operates nearly 1,400 restaurants under 19 different brands in Canada, has experienced what appears to be a significant security incident impacting several of its brands.

The company — formerly Cara Operations — on Monday noted that a malware outbreak caused a partial network outage at nine of its franchises. Among those impacted were Swiss Chalet, Harvey's, East Side Mario's, and Kelseys. A "small number" of restaurants have been closed for a "temporary period of time" because of service issues related to the malware, the company said in a statement.

In a report Wednesday, CBC News described Recipe as the victim of a ransomware attack that forced several locations across Canada to temporarily close down this week. CBC posted a copy of a ransom note that it said had been obtained from a worker at one of the affected restaurants, who described all systems at that location as having crashed.

In the ransom note, the hackers claimed to have used the "strongest military algorithms" to encrypt critical company files and were demanding an unspecified amount of money in Bitcoin, CBC said.

"The final price depends on how fast you write to us," the purported ransom note said. "Every day of delay will cost you additional +0.5 BTC."

Dark Reading was unable to independently verify CBC's report that ransomware was the cause for the network disruptions at Recipe. The company did not immediately respond to an inquiry seeking a status update and information on how many restaurants might have been impacted, how many locations were forced to temporarily close down, and whether, in fact, ransomware was the cause.

Recipe's statement merely noted that the company discovered the malware outbreak Sept. 28 and took immediate steps to mitigate damage. A number of systems have been taken offline, and Internet access has been suspended to all of the affected locations.

The measures have caused service delays at some locations, leaving them unable to accept payment card transactions. However, those locations are continuing to process card transactions manually, Recipe said. "A smaller number of affected restaurants have decided to close for a temporary period of time to avoid inconvenience to guests due to service issues," it added.

CBS quoted a Recipe spokeswoman as denying the incident was ransomware-related. The ransom note that the worker purportedly provided to CBS was also just a generic statement associated with malware named Ryuk that surfaced earlier this year, the spokeswoman reportedly said.

If Recipe, in fact, was the victim of a ransomware attack, it certainly wouldn't be surprising. Security vendor RiskIQ recently estimated that 90 organizations fall victim to ransomware every hour. Just one example is the Port of San Diego, which last week experienced major network disruptions related to a ransomware attack. Over the course of this year, numerous others have been similarly hit, including Boeing, the City of Atlanta, the Colorado Department of Transportation, and the Erie County Medical Center.

RiskIQ estimates the average cost to businesses from such attacks at around $15,220. But some victims end up paying many magnitudes more. Erie County Medical Center, for instance, estimated it spent $10 million on recovering from its ransomware attack; the City of Atlanta pegged its costs at $5 million on emergency IT services alone, and Colorado's DoT spent more than $1.5 million.

Related Content:

Black Hat Europe returns to London Dec 3-6 2018  with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.