Cyber Threat Actor: Null Byte

The threat actor is publiclyknown only by the alias Null Byte and has been linked to a single incident that occurred in Canada. No additional aliases, personal identifiers, or biographical details about the actor have been disclosed in open sources. The actor’s geographic association with Canada is inferred from the location of the target and the reporting of the event.

On February 27 2018 a computer virus compromised Windows XP‑based cash registers at numerous Tim Hortons locations across the country, causing the registers to crash and disrupting point‑of‑sale operations. The infection affected more than 1,000 stores, leading some franchises to suspend service temporarily and others to close permanently. The outage produced measurable financial consequences including lost sales revenue, continued wage payments for idle staff, and spoilage of perishable food items. Franchise owners publicly criticized the parent company’s IT practices and demanded compensation for the losses incurred. Tim Hortons’ parent organization stated that no customer payment data was compromised, although it qualified this assertion as premature given the early stage of the investigation. To address the failure the company engaged external vendors to restore the affected systems and to investigate the origin of the virus.

The observed tactics involve deploying a virus that specifically targets legacy Windows XP point‑of‑sale terminals, rendering them inoperable. Public reporting does not disclose the malware family name, the specific initial infection vector, or any ancillary tools used alongside the virus. Consequently, the technical profile of Null Byte remains limited to the described disruptive effect on outdated POS hardware.

No credible public sources have attributed the activity to a state sponsor, a criminal consortium, or any other identifiable group; no statements linking the actor to a particular nation‑state or organized crime network have been made. Likewise, no evidence of broader affiliations, collaborative operations, or recurring campaigns has been presented in the available material.

The Null Byte actor is therefore defined solely by this single reported incident, which highlights the vulnerability of outdated point‑of‑sale systems in the Canadian fast‑food retail sector and demonstrates how a piece of malware can cause widespread operational disruption and financial harm without necessarily compromising payment data. No further activity or additional campaigns have been publicly associated with the alias at this time.