The Fake Invoice That Bricked 300 Restaurants

It was a Wednesday afternoon, and the office manager at a regional restaurant group was clearing invoices. One email looked like it came from their linen service. The logo was right. The dollar amount was plausible. She opened the PDF attachment.

Nothing happened. No warning. No pop-up. She moved on to the next task.

Two hours later, the POS terminal at the flagship location froze mid-transaction. A server called the manager over. They rebooted the terminal. It came back to a screen nobody recognized.

By 4 p.m., screens at three more locations had gone dark. The scheduling app would not load. The shared drive where managers kept vendor contacts and order sheets was locked behind a message demanding payment in cryptocurrency.

By the time the dinner rush started, the general manager was on the phone with their POS provider, slowly realizing this was not a glitch. It was ransomware. Every system connected to the same network and the same set of passwords had been encrypted.

This is not a hypothetical. In January 2023, a ransomware attack forced Yum! Brands to temporarily close nearly 300 restaurants in a single day. Three months later, a separate attack hit an NCR data center and knocked out Aloha POS systems used by thousands of restaurants and retailers, with full recovery stretching into the following week. The details vary. The pattern does not. A mundane email. A single click. Then silence, followed by chaos.

The timeline that follows draws from these documented incidents and others like them. Exact forensic details from individual franchise-level attacks are rarely made public. But the operational fallout looks the same whether you run five locations or five hundred.

What a Dark POS Screen Does to a Friday Night

The most immediate crisis is the one customers feel first. When the POS goes down, you cannot process card payments. In a business where most customers pay with cards, that is not an inconvenience. It is a shutdown.

Picture a Friday dinner rush. A server finishes taking an order and walks to the terminal. The screen is locked. There is no backup terminal because they all run on the same system. The manager pulls out a pad of paper and starts handwriting tickets. Each one takes three or four times longer than tapping a screen. The kitchen gets tickets it can barely read. Orders get lost. Wrong dishes go to wrong tables. Table turns slow to a crawl.

Meanwhile, someone tapes a handwritten sign to the front door: CASH ONLY. Half the customers in line walk away. The ones who stay dig through wallets, and servers scramble to make change from a register that was not stocked for a full night of cash transactions. Tips are a mess. At the end of the night, reconciling what was sold against what was collected is guesswork.

That is just the payment side.

Restaurant margins typically run 3 to 5 percent. One full day of this can erase a week of profit. A multi-day outage does not just cut into margins. It threatens whether the business can cover rent, payroll, and supplier invoices that month. With small business bankruptcies already spiking, the financial buffer for most operators is razor thin.

The scheduling software is locked too. Nobody knows who is supposed to work tomorrow. Managers start calling staff one by one, working from memory, because the contact list lived inside the app. Some employees do not answer. Others show up for shifts that no longer exist.

Vendor deliveries arrive the next morning. The produce order, the meat order, the dry goods. But the inventory system is frozen. Nobody can check what was actually ordered versus what showed up. Product sits in the walk-in with no clear plan. Food that was ordered for specials that cannot be run starts to age. Waste adds up fast.

Online ordering and the customer-facing app are dead. For locations that pulled 20 or 30 percent of revenue from digital orders, that money simply vanishes. There is no fallback. Regulars who try to place their usual order get an error screen and go somewhere else.

Within 48 hours, the one-star reviews start appearing. “Showed up and they could only take cash.” “Waited 45 minutes for the wrong order.” The reputational damage outlasts the technical recovery.

Someone Changed All the Locks Overnight

Think of your business systems like a building with many rooms. Your POS is one room. Your scheduling tool is another. Your shared drive, your email, your accounting software. Each room has a lock. In most small operations, the same key opens every door. That key is a password.

Phishing is how the attacker gets a copy of that key. A phishing email is a fake message designed to look like it came from someone you trust. A vendor, a supplier, your bank. It asks you to click a link or open an attachment. The goal is to trick you into giving up your login credentials or installing software you did not ask for. These emails are not obvious fakes. They use real logos, real formatting, and realistic dollar amounts. Careful, experienced people fall for them regularly. The FTC says imposter scams have been the most-reported fraud category for nine straight years, and many of them start with exactly this kind of email.

Once the attacker has that one key, here is what happens next. The malicious software installs silently. It does not announce itself. It starts looking for other systems it can reach using the same credentials. If your POS, your email, and your scheduling tool all use the same password, the malware walks through every door in the building.

Then it changes all the locks. That is encryption. Your files, your data, your systems are all still there. But you cannot open any of them. The attacker leaves a note on the screen offering to sell you the new keys.

Shared or reused passwords are what make this spread so fast. If every employee logs into the POS with the same account, one compromised password hands the attacker access to every terminal at every location. The blast radius expands with every shared login. Scam emails that look like routine business correspondence are the most common way this starts. It is the same trick used in fake LLC compliance letters that target small business owners through the mail. Different channel, same principle: make it look official, and people act without questioning it.

Multi-factor authentication (MFA) is a second lock that requires something beyond just the password. Usually a code sent to your phone or generated by an app. Even if an attacker steals the password, they cannot get in without that second piece. It is free on most platforms. And it blocks the vast majority of these attacks before they start.

Attackers also tend to time these attacks for evenings, weekends, or holidays. The window when nobody is watching the systems closely is exactly when the malware does its work.

Your POS Vendor Gets Hit and You Go Down With Them

There is a version of this story where you do everything right. Your passwords are strong. Your staff is trained. Your network is locked down. And you still lose your systems, because your POS vendor got attacked instead.

That is what happened on April 12, 2023, when ransomware hit an NCR data center. NCR runs the Aloha POS platform that thousands of restaurants depend on daily. When NCR’s systems went down, restaurants using Aloha lost access to key functions. NCR was still restoring applications days later. The restaurants had no say in the matter and no way to fix it themselves.

If your POS provider or your main cloud platform went down tomorrow morning, do you know what you would do by lunchtime?

Why It Took Three Days Instead of Three Hours

The attack itself was fast. Recovery was not. And in most cases, the reason recovery dragged on had nothing to do with the sophistication of the attack. It had to do with gaps in preparation that nobody noticed until it was too late.

The biggest gap was backups. The restaurant group had backups. On paper, that sounds fine. But the backup drives were connected to the same network as everything else. When the ransomware encrypted the POS data and the shared drive, it encrypted the backups too. Everything was locked behind the same wall. Even in cases where backups are stored separately, many operators have never actually tried restoring from them. They assume the backup works because the software says it ran last Tuesday. But a backup that has never been restored is just a file sitting on a disk somewhere. Nobody knows if it contains what they think it does, or if the restore process actually works, until they test it. A prepared operator runs a restore test once a quarter. It takes an hour. It is boring. And it is the difference between three hours of downtime and three days.

"A backup you have never restored is a wish, not a plan."

The second gap was the complete absence of a manual-operations plan. When the screens went dark, nobody on staff had ever practiced taking orders by hand. Nobody knew where to find paper ticket pads. Nobody had thought through how to handle a cash-only dinner rush, or how to communicate to a dining room full of people that the card readers were down. The result was slow, stressful improvisation. Kitchen errors doubled. Some locations closed early because the chaos was not worth the handful of cash transactions they were processing. A one-page printed procedure, stored at each station, would have cut the confusion in half. Not eliminated it. But staff would have known the first three things to do instead of freezing.

Shared logins made the blast radius bigger than it needed to be. Every manager at every location used the same login for the POS system. The scheduling app had one account shared across the group. When one set of credentials was compromised, every location was exposed at once. Separate logins for each person would have contained the damage. If only one location’s credentials were stolen, only that location would have been hit.

Finally, nobody had a contact list for incident response. The owner did not know whether to call the POS vendor first, the insurance company, an IT consultant, or a lawyer. Hours were lost figuring out who to reach and finding phone numbers that lived inside the now-encrypted email system. A laminated card with four phone numbers, stored in the office, would have saved most of that time.

None of these are exotic failures. None of them require technical expertise to prevent. They are the kind of thing that gets skipped because the day-to-day business is busy, and nobody imagines needing them until the moment they do.

Your Screens Are Dark. Here Is What You Grab Off the Wall.

This is not a cybersecurity checklist. This is a plan for the moment your systems are already down and you need to keep operating. As the law firm Anderson Kill advises: develop a written business continuity plan and keep a hard copy to access when your systems are locked. If your plan lives in Google Drive, it is locked behind the same wall as everything else.

Print this. Put it where people can reach it.

Five Fixes That Cost Less Than One Lost Dinner Shift

Give every person their own login. If one password gets you into everything, one phishing email gets the attacker into everything. Set up individual accounts for each employee on your POS, scheduling tool, and email. When someone leaves, you deactivate one account instead of changing a password that twelve people share. This takes an afternoon, and most platforms support it at no extra cost.

Turn on MFA everywhere it is available. It costs nothing. It blocks most credential-based attacks. If your POS, email, or accounting platform offers it, enable it today.

Test your backups quarterly. This is the most commonly skipped step and the one that matters most when something goes wrong. Do not just verify that a backup ran. Actually try restoring data from it. Open the files. Check that the POS configuration, your menu data, and your employee records are there. Do this once every three months. Put it on the calendar like a health inspection. The hour it takes is nothing compared to the days you will lose discovering your backup is empty or corrupted after an attack.

Run a 15-minute phishing awareness session. Any employee with an email login should see two or three examples of real phishing emails and hear one simple rule: do not click, report to your manager immediately. The most expensive cybersecurity failure in restaurants starts with someone who was never shown what a fake invoice looks like.

Ask your POS vendor one question. “If your systems get hit by ransomware, what happens to my data and my ability to process transactions?” If they cannot answer clearly, that tells you everything you need to know about your exposure. Ask it now, not after an outage.

Each of these costs less in time and money than a single lost dinner shift.

43% of Businesses Have Already Been Here. Your Insurance Might Not Help.

43% of businesses have experienced a cyber breach. That is not a future risk. It is a current reality, according to industry research from Cardonet.

If customer payment card data was exposed, PCI DSS (the Payment Card Industry Data Security Standard, a set of rules for handling card data) obligations kick in. That can mean a mandatory forensic investigation, customer notification costs, and fines from card networks. These costs land on top of the revenue you already lost. It is worth keeping up with regulatory changes that affect your compliance obligations, because the rules tighten steadily and ignorance is not a defense.

This pattern is not limited to restaurants. The same risk hits any business that depends on a small number of cloud platforms and has loose access controls.

• A marketing agency that lives in Google Workspace and a project management tool loses client files, deadlines, and invoicing if one account is compromised.
• An ecommerce seller on Amazon or Etsy whose account gets hijacked loses revenue every hour the listing is down.
• A SaaS team whose cloud hosting credentials are phished could lose their entire production environment overnight.

The shared thread: few platforms, weak access controls, no contingency plan. The same five controls from the previous section apply to every one of these businesses.

Start This Week. Be Ready in a Month.

Week 1

• Audit who has login access to your POS, email, scheduling, and financial tools.
• Remove former employees and anyone who no longer needs access.
• Eliminate shared logins. Create individual accounts.

Week 2

• Turn on MFA for every system that offers it.
• Call your POS vendor. Ask what happens to your data and operations if their systems go down.
• Ask whether your POS has an offline transaction mode and document how to activate it.

Week 3

• Run a real backup restoration test. Open the restored files and verify the data is complete.
• Print your paper-mode plan: manual order slips, cash-only protocol, emergency contact card.
• Place physical copies at each station and in the manager’s office.
• Print a current staff contact list and shift schedule. Store copies in two locations.
• Write your stay-open-or-close decision tree and name the person who makes that call.

Week 4

• Run a 15-minute team meeting. Show two or three real phishing email screenshots. Explain the rule: do not click, report to your manager.
• Pull out your cyber insurance policy. Confirm what controls it requires and whether you meet them.
• Schedule a quarterly repeat of the backup test and phishing refresher.