A data dump from an alleged cyber attack on McDonald’s in 2022 concluded with the last bit of information being released on the dark web.
According to threat researcher Dominic Alvieri, the latest post by Snatch ransomware is believed to be the ultimate data dump stemming from the alleged 2022 cyber attack on the fast food chain.
This particular cyber attack on McDonald’s marks the second incident following a breach in June 2021.
According to Ransomwaremap, the cyber attack on McDonald’s last year was attributed to the Snatch ransomware group. The Daily Mail also reported that the hackers claimed to have stolen 500 gigabytes of data from the company.
Cyber attack on McDonald’s: Why do food chains face data breaches?
In 2022, an alleged McDonald’s data breach occurred, which appeared to be accompanied by a demand for an undisclosed ransom. However, this McDonald’s data breach is not the first attack the American fast food chain has faced.
In 2021, McDonald’s faced a similar attack where hackers in South Korea and Taiwan accessed a small chunk of customers’ data.
Although payment details were not compromised, sensitive information such as email addresses, delivery addresses, and phone numbers were exposed.
McDonald’s promptly initiated security measures to inform the affected customers and regulatory authorities about the breach.
However, cyber attacks on fast food chains has only increased in recent years. Fast food chains and restaurants are rather distinctive targets for hackers.
According to QSR magazine, the McDonald’s cyber attack and other restaurants facing cyber attacks in general share frightening similarities.
In most cases of cyber attacks on restaurants, the food establishments share a “striking vulnerability.” This could include unpatched point-of-sale systems and outdated Microsoft operating systems, and since these systems are interconnected with devices and servers, they become an easy target for hackers.
Moreover, most of these restaurants have minimal to no capability to identify a data breach on their own, and hackers can latch on to their systems for months and years without anyone noticing.
According to FireEye’s Mandiant M-Trends 2019 report, the average dwell time for enterprises has been steadily decreasing, reaching an average of 78 days. However, in the case of attacks targeting restaurant chains, this duration stretched to around a year and a half.
Who is the Snatch ransomware group?
The Snatch ransomware group, responsible for the McDonald’s cyber attack, has been active since 2018. Like other ransomware variants, Snatch exploits vulnerabilities in Windows systems, utilizing Windows Safe Mode and privileged service.
By creating a malicious Windows service, the ransomware ensures its persistence even in Safe Mode, making it challenging for anti-malware tools to detect it.
To further hinder its presence from the victims, the Snatch ransomware disables Windows Defender and removes Volume Shadow Copies and backups.
The ransomware group has been in the spotlight for targeting high profile companies, and the recent cyber attack on McDonald’s is just another victim on its list.
Moreover, McDonald’s is not alone in facing cyber threats within the fast-food industry. KFC, Pizza Hut, Taco Bell, and The Habit Burger Grill, all owned by Yum Brands!, recently experienced a ransomware attack in the UK, though not claimed by the Snatch ransomware group.
Approximately 300 restaurants were affected in this attack, prompting temporary closures for all the major fast food restaurants in the UK. However, Yum Brands! assured customers that no evidence suggested the exposure of personal information.
Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.