Who: Huddle House

# of Records: 300,000 customers

When it occurred: On or after August 2017 until February 1, 2019

What Happened: Some of their 350 franchisee-operated restaurants experienced a payment card breach.

How it Happened: Criminals compromised a third-party point of sale (POS) vendor’s data system and utilized the vendor’s assistance tools to gain remote access—and the ability to deploy malware—to some Huddle House corporate and franchisee POS systems.

Outcome: Huddle House disclosed that they only became aware of the incident when they were contacted by a law enforcement agency and Huddle House’s credit card processor. Huddle House did not know how many locations may have been impacted or how many customers may have had their card data compromised, but based on their investigation to date, they advised that if customers had used a payment card at any Huddle House locations on or after August 1, 2017, the card information might be at risk. Huddle House data is for sale on one of the largest currently active dark web marketplaces