Mise En Place Restaurant Services

Summary

Mise En Place Restaurant Services experienced a ransomware attack involving unauthorized access to its network over a period of several days. The company engaged IT consultants and a third-party forensic firm, which confirmed the breach but found no evidence of data misuse. Potentially compromised information included sensitive personal and financial details such as names, addresses, Social Security numbers, government-issued IDs, bank account numbers, and login credentials for financial or vendor accounts. Impacted parties were notified, and the organization implemented security measures including password resets while offering a dedicated contact line for inquiries.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On March 15, 2018, Mise En Place Restaurant Services, Inc. (MEP) discovered a potential ransomware attack affecting part of its network. The company immediately engaged its IT consultant to initiate an investigation and concurrently hired a specialized third-party forensic IT firm to assess the breach. As a precautionary measure, MEP changed all network passwords to contain the incident. The forensic investigation determined that unauthorized actors had accessed MEP’s server during a nine-day period from March 6 to March 15, 2018. While the ransomware attack prompted the discovery, the forensic analysis confirmed broader unauthorized access beyond the initial encryption event. MEP publicly disclosed the incident on April 13, 2018, emphasizing that no evidence suggested business or personal information had been misused.

The compromised server contained sensitive client and individual information potentially exposed during the breach window. This included full names, addresses, Social Security Numbers, Federal Identification Numbers, passport numbers, driver’s license details, resident card numbers, bank account and routing numbers, and login credentials for bank accounts, insurance portals, or vendor systems provided to MEP. Impacted parties received written notifications, though MEP acknowledged the scope of exposure varied across individuals and business entities. The company established a dedicated call center (1-888-292-8414) for those who believed their information was maintained by MEP but did not receive direct notification. No ransomware payment details or data recovery status were disclosed in the public announcement.

Sources

Sources available to members: 1 source.