Restaurant customer management platform SevenRooms has confirmed it suffered a data breach after a threat actor began selling stolen data on a hacking forum.
SevenRooms is a restaurant customer relationship management (CRM) platform used by international restaurant chains and hospitality service providers, such as MGM Resorts, Bloomin’ Brands, Mandarin Oriental, Wolfgang Puck, and many more.
On December 15, a threat actor posted data samples on the Breached hacking forum, claiming to have stolen a 427 GB backup database with thousands of files containing information about SevenRooms customers.
The samples provided by the seller include folders named after big restaurant chains, clients of SevenRooms, API keys, promo codes, payment reports, reservation lists, and more.
After BleepingComptuer contacted SevenRooms about the data being sold online, they confirmed that it was their data was caused by unauthorized access to the systems of one of its vendors.
The company clarified that guests’ credit card information, bank account data, social security numbers, or any other similarly highly sensitive information was not stored on compromised servers, so it was not exposed in the attack.
