Restaurants sue vendors after point-of-sale hack

Point-of-sale computer-maker Radiant and a local reseller have been sued

When Keith Bond bought a computerized cash register system for his Broussard, Louisiana, restaurant, he thought he was modernizing his restaurant. Today, he believes he was unwittingly opening a back door for Romanian hackers who have now cost him more than US$50,000.

Bond's is one of more than a half-dozen Louisiana restaurants that have sued the makers of their point-of-sale system, alleging that the companies that made and resold the systems are the ones who should be responsible for fines levied by payment processors following the hack.

His story reads like a warning for small businesses, who in connecting their businesses to the Internet, have also become prey for sophisticated cyber-criminals.

Bond says that systems at his Mel's Diner, Part II, were hacked, along with several other restaurants in the region, sometime around March 2008. Investigators told him that the systems were compromised by Romanian hackers who used the devices' remote access software to steal credit card numbers from the systems. This software let Bond's reseller, Computer World, provide remote support to the systems. The criminals took those credit card numbers and then used them to make fraudulent purchases throughout the U.S., he said.

In the class-action lawsuit, Bond and the other plaintiffs allege that their point-of-sale systems were out of compliance with the Payment Card Industry Data Security Standard (PCI DSS), which defines how secure the big credit card companies expect their merchants' computers to be. Bond and others blame the maker of his Aloha point-of-sale system, Radiant Systems, and its Louisiana reseller, Computer World (Computer World is not related to IDG's ComputerWorld magazine).

After the hack, Bond had to spend close to $20,000 to audit his systems. He was then assessed tens of thousands of dollars in fines and chargeback fees generated by the 699 credit card numbers that were stolen from his three point-of-sale devices.

"Our clients are restaurants," said Bond's lawyer, Charles Hoff, in a statement. "They are food experts, not technologists. When major players in the hospitality industry such as Radiant Systems and its distributors say their software and business practices are PCI-DSS compliant, our clients trust them."

The class-action lawsuit was filed in October but was not widely known until the privacy blog disclosed it last week. Another similar lawsuit was filed against Radiant and Computer World in April.

Citing company policy, a Radiant spokeswoman declined to comment on the lawsuits, but in an e-mailed statement, she said that the company believes that the allegations are without merit. "These customers were victims of criminal acts almost two years ago. Unfortunately, in today’s world criminal acts like these are not uncommon in the restaurant industry," the statement read.

Bond doesn't buy that. "You're buying an expensive point-of-sale system," he said. "But when you're compromised, Visa and Mastercard come after the merchant. There's no level of responsibility with the processor, the reseller or with Visa Mastercard. So the merchant is the person who is suffering."

The lawsuit claims that Visa warned Radiant and Computer World that they were not PCI compliant the year before the hack, but that merchants were never notified of these problems, even though they were the ones who ultimately had to pay big fines.

That's a real problem, said Avivah Litan, an analyst with the Gartner research firm. "Merchants should be notified directly when Visa or MasterCard issue alerts about non-compliant software," she said in an e-mail interview. "Restaurants are in the business of selling food; they should not be expected to be experts in the intricacies of credit card processing certification processes, especially when they are not even privy to most of the communications surrounding them."

Radiant warned about the problem, according to a security alert (PDF) posted by a San Francisco Bay Area Radiant reseller. The alert warned Aloha users to disable a Remote Desktop feature on their equipment if it's not being used to provide remote support to the point-of-sale system. The plaintiffs in Bond's lawsuit say they received no such alert. Computer World did not respond to a request for comment on this article.

According to Bond, Computer World used this Remote Desktop feature to access his systems. To make matters worse, Computer World had set up his and other restaurants with the same default password: "Computer," Bond said.

Join the CSO newsletter!

Error: Please check your email address.

Tags poshacke-commercelegalpoint-of-sale

More about GartnerMastercardRadiant SystemsVisa

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Robert McMillan

Latest Videos

  • 150x50

    CSO Webinar: Will your data protection strategy be enough when disaster strikes?

    Speakers: - Paul O’Connor, Engagement leader - Performance Audit Group, Victorian Auditor-General’s Office (VAGO) - Nigel Phair, Managing Director, Centre for Internet Safety - Joshua Stenhouse, Technical Evangelist, Zerto - Anthony Caruana, CSO MC & Moderator

    Play Video

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

More videos

Blog Posts

Market Place