McDonald’s became an unintended case study over the summer on the security risks that restaurants face from its third-party venders.
Some “white hat” hackers testing the McHire chatbot hiring screener, Olivia, were easily able to get into the system after finding basic security flaws. Among them: an administrator default password of 123456 that Paradox.ai, had left in place. McHire is used by the majority of McDonald’s franchisees; the personal information of 64 million job applicants was potentially exposed.
McDonald’s wasn’t the only fast-food organization found to have cyber security exposures last year. A different team of ethical hackers in September found “catastrophic” vulnerabilities in the systems of Restaurant Brands International’s fast-food chains like Burger King and Popeyes, including hard-coded passwords.
What makes these breaches particularly alarming isn’t just the scale—it’s how easily they were discovered by ethical hackers in routine testing. If white hat hackers can find these vulnerabilities in days, malicious actors have likely already identified similar weaknesses across the industry. More troubling: most franchisees remain unaware their systems have been compromised until weeks or months after the fact, when customer data is already being sold on dark web marketplaces. The average time to detect a breach in the restaurant industry is 212 days—more than enough time for criminals to extract payment card data from thousands of transactions.
Third-party cyber vulnerabilities like this have been worsening as technology becomes an increasingly important driver of restaurant operations. Some 99 percent of restaurants use at least one online ordering solution; 67 percent of operators say the majority of their software systems overall integrate into their indispensable point of sale (POS). Meanwhile, data breaches involving third-parties have doubled to 30 percent of all incidents in the past year.
Cyber risk management has never been more important. But restaurant management must focus on their vendors’ security practices as much as their own. And for QSR franchisees, it’s absolutely essential to understand the franchisor’s requirements for purchasing insurance—including for cyber coverage.
Do vendor cyber security practices pass the ‘test’?
System-wide vendors are the franchisor’s responsibility to adequately vet. Even so, franchisees must follow the franchisor’s security guidelines in their own operations and also for vendors they hire locally.
In evaluating their local vendors, it’s critical to audit their cyber security practices as well as the framing of vendor contracts to ensure indemnities are clearly specified. (A broker experienced in cyber risk management and familiar with franchise systems is an invaluable partner in this.)
The vendor cyber audit should cover:
- Data security and privacy policy documentation, including specifics on policies enforced.
- Vendors’ response and recovery plans, including for business continuity in the event of an incident.
- Confirmation of and details about staff training programs.
- Detailed information on technical controls and data and compliance measures.
- Evidence of vendors’ own risk assessments and client reporting protocols.
Total costs: $3.7 million. Insurance payout: $400,000.
The difference? Their franchisee had simply matched the franchisor’s minimum requirement without analyzing their actual exposure.
The complications of franchisee insurance
Insurance for the franchise organization presents a “don’t try this at home” (or without expert guidance) situation.
Franchisees may own one or two restaurants or 100. They’re not all tuned in to different types of risk exposures and twists in buying insurance. Regardless of size, each must have the same type of coverage.
Here’s a typical scenario. Say a major franchise chain pushes out a POS system that franchisees are using at the franchisor’s request. Franchisees can also get insurance through franchisor’s risk purchasing program with a corporate policy. These considerations become important:
- Will the $5 million aggregated limit under the master policy be adequate protection when hundreds or thousands of other franchisees are also exposed?
- Does the franchisee go with the franchisor’s master program, which limits its place in line in the event of damages, but is less costly?
Does it want to make sure its costs and exposures are covered first?
Managing cyber risk clearly becomes more complicated in the franchise environment, and the risks only mount for a growing franchisee as each new store opens another door for exposure. The risk is compounded by expanded technology adoption. But here’s what keeps experienced franchise operators up at night: it’s not whether a cyber event will happen—it is when, and whether you’ll have the right coverage and the right broker to survive it. Every facet of cyber security should be a top priority for successful restaurant organizations, and that starts with choosing an insurance partner who truly understands that your franchise isn’t just another policy number, but a complex operation where a single vendor vulnerability could threaten everything you’ve built.
Patrick Ryder is Senior Vice President and management and professional liability segment leader for leading insurance brokerage Hub International.
