Microworks Listed by rhysida Ransomware Group

On October 15, 2024, Microworks appeared on the leak site operated by the rhysida ransomware group. The company, which provides Point of Sale Prism systems for pizza delivery, restaurant management, and franchise food service operations, is claimed to have had internal files exfiltrated during a ransomware attack. The listing does not specify the number of people affected or detail exactly which records were taken.

Primary Disclosure Details

The rhysida leak site listing states that Microworks suffered a ransomware incident in which attackers exfiltrated internal files. No victim count, ransom amount, or specific data categories such as customer payment records or employee information are disclosed in the primary posting. The notification confirms the data was obtained through a ransomware attack but provides no further technical breakdown of the initial access vector or exfiltration method. Public copies of the listing, hosted on ransomware.live, preserve these limited facts without additional claims.

October 15, 2024 marks the first public disclosure date through the attackers’ own leak portal.

Why This Matters for You and Your Family

If you have ordered food through a restaurant or franchise that uses Microworks’ Point of Sale Prism system, your name, address, phone number, or payment details may have been stored in the compromised internal files. Even when the leak site does not list exact data types, point-of-sale providers routinely handle customer orders, delivery addresses, and transaction logs. That information sitting in exfiltrated archives creates long-term risk for identity theft, phishing campaigns, and unwanted contact. Your family’s everyday purchases can quietly become ammunition for criminals who now hold files they were never supposed to see.

Doxxing and Identity-Chain Implications

Exfiltrated internal files from a point-of-sale vendor often contain spreadsheets or databases that link customer names to delivery addresses, phone numbers, email accounts, and sometimes loyalty program identifiers. Once attackers publish or sell that material, it becomes raw material for doxxing chains. A single address can be cross-referenced with usernames found in other breaches, turning an innocent pizza order into a pathway that reveals social-media handles, children’s names, or even gaming accounts tied to the same household. These linkages expand quickly; what begins as a restaurant record can cascade into full identity profiles used for harassment, targeted scams, or account takeovers.

Rhysida’s Known Track Record

Public reporting attributes the first activity of the rhysida ransomware group to May 2023. Since then the group has claimed responsibility for attacks on healthcare providers, educational institutions, and technology companies. Their typical playbook involves gaining initial access through compromised remote desktop credentials or exploited vulnerabilities, followed by exfiltration of sensitive files before deploying encryption. Rhysida then posts samples or full archives on their leak site when victims do not pay, applying pressure through both data exposure and the threat of continued publication. The group’s naming of Microworks fits this established pattern of targeting mid-sized service providers whose internal systems hold customer and operational data.

What to do

• Rotate any password you have reused at restaurants, delivery services, or loyalty programs that might have fed data into Microworks systems, and switch to 2FA using an authenticator app instead of SMS.
• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup handled by the service.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces in hours rather than months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often chain back to the same address or parent email and become targets after credential leaks like this one.
• Let remediation specialists manage takedown requests for any exposed personal records that appear on broker sites or forums.

The incident underscores how data collected for something as routine as ordering dinner can later surface in ransomware leaks and fuel broader identity compromises. Starting proactive steps now limits how far those chains can reach. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts vulnerable to cascading takeovers.