Notice of Payment Card Incident

News provided by

Nov 22, 2019, 15:00 ET

NEW YORK, Nov. 22, 2019 /PRNewswire/ -- Catch Hospitality Group ("Catch") takes the security of payment card data very seriously. Catch is notifying customers of Catch NYC (including Catch Roof) and Catch Steak about an incident involving payment cards that was recently identified and addressed. This notice explains the incident, measures that have been taken, and some steps customers can take in response.

Catch recently launched an investigation after detecting unauthorized activity on some payment processing systems, and a leading cybersecurity firm was engaged to assist. The investigation identified the operation of malware designed to access payment card data from cards used on certain point-of-sale ("POS") devices at Catch NYC (including Catch Roof) and Catch Steak. The malware searched for track data (which sometimes has the cardholder name in addition to card number, expiration date, and internal verification code) read from a payment card as it was being routed through these POS devices. There is no indication that other customer information was accessed.

Catch NYC and Catch Steak use two different POS devices – one that is brought by the waitstaff to a table and another at the bar and areas where dining area waitstaff enter orders for the kitchen. Almost all of the dining area transactions occur on devices brought to a guest at the table. Those transactions were not involved in this incident because those devices use point-to-point encryption technology. The cards involved in this incident are cards used at the bar or in the rare circumstances that a card was swiped at the device where waitstaff enter orders. The specific timeframes when payment card data may have been accessed by the malware vary between the two locations. For Catch NYC (including Catch Roof), the timeframe was from March 19, 2019 through October 17, 2019. For Catch Steak, the timeframe was September 17, 2019 through October 17, 2019.

During the investigation, Catch removed the malware and implemented enhanced security measures and continues to work with cybersecurity experts to evaluate additional ways to enhance the security of payment card data. In addition, Catch has reported the incident to its payment processor and is supporting an investigation by law enforcement.

It is always advisable for customers to review their payment card statements for any unauthorized activity. Customers should immediately report any unauthorized charges to the card issuer because payment card rules generally provide that cardholders are not responsible for unauthorized charges reported in a timely manner. The phone number to call is usually on the back of the payment card.

For more information, please visit https://catchrestaurants.com/catchsteaknyc/paymentcardincident or https://catchrestaurants.com/catchnyc/paymentcardincident.

SOURCE Catch Hospitality Group