Avanti Markets

Profile narrative

Avanti, also known as Avanti Markets, is a United States-based vendor associated with self-service food kiosks. Its core activity, as reflected in the available information, involves automated food retail through kiosk-based systems. The organisation’s kiosks supported customer purchases using payment technology. Credit card processing was part of the kiosk payment environment. The company also supported stored-value Market Cards for some users. Some users could use fingerprint verification in connection with the service. These features place Avanti in the self-service food retail and payment-enabled kiosk sector. The available information does not provide employee numbers, revenue, customer counts, or a detailed list of markets served.

On 2017-07-04, Avanti experienced a malware attack that affected its payment systems. The malware was identified as PoSeidon, also known as FindPOS. The attack compromised customer payment card information, including cardholder names, card numbers, and expiration dates. It also potentially exposed biometric data from users who had used fingerprint verification. Names and email addresses of users of stored-value Market Cards were also potentially exposed. The malware was distributed through the vendor’s corporate network to its kiosks. As a result, credit card processing was temporarily shut down at some locations. Analysis associated with the incident found that approximately half of the kiosks lacked point-to-point encryption. This absence of encryption increased the vulnerability of the affected payment environment.

Avanti’s distinguishing attribute in the available material is its combination of self-service food kiosks, electronic payments, stored-value cards, and fingerprint verification. The incident showed that compromise of a corporate network could extend to distributed kiosk payment systems. It also showed that security controls were not consistent across the kiosk environment. The case drew attention to risks involving third-party-managed IoT devices and insufficient network segmentation in payment settings. No parent company, subsidiary relationship, or ownership structure is identified in the available information. No additional confirmed details about the organisation’s size, geographic footprint, or product range are provided.

Incidents

1 incident linked to this organisation.