Cyber Incident Victim: E-Dining Express
Date:
Apr 2021
Location:
United States of America
Summary
A cybersecurity breach impacted multiple online restaurant ordering platforms, including E-Dining Express, compromising approximately 343,000 payment cards through Card Not Present (CNP) fraud. The incident involved Magecart attacks deployed by the Keeper hacking group, targeting platforms serving as either direct ordering infrastructure for individual restaurants or supplementary third-party services. At least 70 restaurants experienced direct data exposure from compromised payment systems, while hundreds more were indirectly affected through infected third-party infrastructure. The breach highlighted vulnerabilities in centralized online ordering solutions, enabling criminals to harvest card data from transactions processed through these platforms. Gemini Advisory initially identified the incidents but later revised its public reporting by removing specific entity names, though without retracting core findings.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
In April 2021, Gemini Advisory reported a series of breaches impacting five online restaurant ordering platforms, including E-Dining Express, occurring over the preceding six months. These breaches exposed approximately 343,000 payment cards through Card Not Present (CNP) fraud. The compromised platforms operated under two distinct models. E-Dining Express fell into the first category, serving as the direct ordering and payment infrastructure for individual restaurants, often integrated with physical point-of-sale (POS) systems. Attackers affiliated with the "Keeper" hacking group deployed Magecart-based skimming attacks to steal payment data directly from transactions processed through these platforms. At least 70 distinct restaurants utilizing E-Dining Express and similar services were confirmed as compromised in this model. The second breach model involved third-party aggregator platforms like Grabull, which supplemented existing restaurant ordering systems, indirectly exposing customer payment data across hundreds of affiliated establishments.
The breaches resulted in widespread payment card theft, impacting consumers who had ordered through affected restaurants between late 2020 and early 2021. Gemini Advisory initially named specific platforms in their April 29 report, but revised their publication in early May 2021 following legal complaints, removing two entity names and modifying text to accommodate "the sensitive nature of this breach and ongoing incident investigations." DataBreaches.net correspondingly updated its coverage to reflect Gemini’s edits but emphasized these changes did not constitute a retraction or correction of the original findings. No specific remediation actions by E-Dining Express or details regarding breach detection timelines were disclosed in available reporting. The incident underscored systemic vulnerabilities in third-party online ordering systems, particularly as demand for such services surged during the COVID-19 pandemic.