HungerRush POS Platform Targeted in Extortion Attack Affecting Thousands of Restaurants Customers of restaurants using the HungerRush point-of-sale (POS) platform reported receiving extortion emails from a threat actor, warning that sensitive data could be exposed if the company fails to respond. HungerRush, which serves over 16,000 restaurants including chains like Sbarro, Jet’s Pizza, and Hungry Howie’s provides POS, online ordering, and payment processing systems. The attack began early Wednesday morning, with the threat actor sending emails from [email protected] and later [email protected], demanding action or risking the exposure of restaurant and customer data. The second email claimed the attacker had access to millions of records, including names, emails, passwords, addresses, phone numbers, birthdates, and credit card details. Analysis of the email headers revealed they were sent via Twilio SendGrid, a platform HungerRush uses for transactional emails, and passed SPF, DKIM, and DMARC authentication checks, suggesting the attacker may have compromised legitimate infrastructure. The emails originated from o10.e.hungerrush.com, a domain linked to SendGrid’s services. Alon Gal, CTO of Hudson Rock, reported that infostealer malware infected a HungerRush employee’s device in October 2025, stealing credentials for NetSuite, QuickBooks, Stripe, Bill.com, Visa Online, and Salesforce. While it remains unclear if these stolen credentials are directly tied to the breach, the incident raises concerns about potential unauthorized access. HungerRush has not confirmed whether the emails indicate a confirmed breach or system compromise. Customers of affected restaurants are advised to remain vigilant for phishing attempts leveraging the potentially exposed data.