SevenRooms breach exposes 1.2M customer records via third‑party vendor file‑transfer interface
What Happened — In December 2022, a hacker forum received more than 400 GB of data from SevenRooms, a restaurant‑customer‑management SaaS. The dump contained 1,205,385 unique email addresses, names and purchase histories. SevenRooms said the exposure stemmed from unauthorized access to a file‑transfer interface operated by a third‑party vendor.
Why It Matters for Trust & Control Assurance
- The incident illustrates a classic supply‑chain control gap: a vendor’s insecure data‑exchange point can become the attack surface for your own customers.
- Continuous third‑party risk monitoring and documented evidence of due‑diligence are the controls that a control‑assurance program expects to have in place to detect and remediate such gaps.
- Demonstrating a defensible audit trail of vendor assessments helps satisfy multiple framework objectives (e.g., NIST CSF 2.0 “Supply Chain Risk Management”).
Who Is Affected – Hospitality and restaurant operators that use SevenRooms for reservations, guest profiling and purchase tracking; downstream partners that rely on the platform’s APIs.
Recommended Actions
- Initiate a vendor‑risk review focused on the compromised file‑transfer service – verify its security posture, contracts and monitoring cadence.
- Collect and preserve evidence of due‑diligence activities (risk assessments, security questionnaires, monitoring logs) to support audit readiness.
- Update your third‑party onboarding and continuous‑monitoring processes to include automated alerts for anomalous file‑transfer activity.
Technical Notes – The breach appears to be a third‑party dependency compromise, likely involving stolen or weak credentials for the vendor’s SFTP/FTPS service. No specific CVE was disclosed. Data types exposed were email addresses, personal names and purchase histories. Source: [Have I Been Pwned – SevenRooms breach]