By Chris Brown
It’s safe to say that modern POS technology has made ordering, fulfilling, and payment handling more efficient for restaurant owners. However, despite all the positives that a modern tech stack can bring to hospitality businesses, it can also create payment security gaps if poorly managed.
Even the smallest of threats can hit hospitality businesses hard; it’s estimated that 60 per cent of small businesses close their doors within six months of a cyberattack.
In addition, more than 30 per cent of hospitality businesses suffered at least one cyberattack in 2025, underscoring why the payment systems running behind every modern restaurant deserve a closer look. And when a breach does occur, the financial fallout can be severe, with recovery, fines, and lost customer trust enough to threaten a small operator’s survival.
Why payment security now goes beyond the POS
The simplicity and accessibility of POS systems can lead business owners to believe that payment security is fairly self-contained. However, payment security extends beyond the literal point of sale – modern POS terminals connect a variety of networks, apps, and internal operations behind the scenes.
The more fragmented this internal network is, the larger the business’s attack surface becomes. The restaurant in question needs to consider what data is handled, how it is stored, and which resources process it. Carefully considering each of these connections and how payment data is processed, is also vital in ensuring that a restaurant business is PCI compliant.
Regardless of your business’s size, you have a duty of care to your customers to keep their payment data safe. What’s more, robust cybersecurity reduces your likelihood of getting breached, facing compliance enforcement, and losing reputation.
Online ordering and delivery apps: Who owns the compliance risk?
One of the more complex areas of payment security and compliance navigation is app partnership. Who owns the data security (and therefore compliance) risk if, say, a restaurant partners with a delivery service?
The answer, thankfully, is fairly straightforward. When partnering with a third-party app, both partners have roles to play in compliance. The app providers handle data security and compliance within their ecosystems; however, any data processed through a restaurant’s POS, or through their integrated software, becomes the latter’s responsibility.
A restaurant is responsible for ensuring the integrity and security of payment data handled up to the point of an app coming into play. Therefore, they are not on the compliance hook for their partners’ data security failures.
That said, it is still good practice to work only with apps and vendors that assure complete compliance and clear data security policies.
Staff access, shared credentials, and everyday human risk
One of the biggest risks to payment data handled and stored via POS and local networking is human operation. It’s estimated that a “human element” is present in around 62 per cent of data breach scenarios, and that this is increasing year-on-year.
Examples of human data mishandling in restaurant scenarios include staff sharing passwords, leaving terminals unattended, and even writing down sensitive bank or card information. These mistakes don’t always lead to large-scale attacks, but do still leave sensitive information open to theft and misuse.
Mitigating these issues may be as simple as requiring multi-factor authentication (MFA) to log in, or reviewing password controls and requiring resets more frequently. Retraining and rebuilding awareness of simple payment security risks, too, can reduce the chances of customer data getting stolen and a business facing compliance enforcement.
What most operators miss in their current setup
One of the biggest security “misses” for smaller restaurant operators is simply failing to update firmware and software patches as soon as they become available. For smaller businesses, this kind of cyber exposure can quickly affect payments, customer data, and day-to-day operations. Outdated or unpatched systems and POS operating software give hackers an easy way in, and the same threats apply if a restaurant insists on using the same legacy systems long beyond their end of life.
It is also easy for small-to-medium hospitality businesses to connect everything to the same network, such as payment terminals and back-office data storage. For example, by connecting each data-handling endpoint to the same, weak Wi-Fi network, hackers again have an easy in-road to infiltrate and attack everything that is connected.
What’s more, while third-party app providers handle their own data compliance, what some restaurant owners miss is carefully controlling the access that other outside vendors have to their systems. For example, outsourced IT vendors, payment handling platforms, or maintenance technicians may all have access to sensitive data.
Therefore, they must take steps to carefully manage what access vendors have to payment information, and to what extent.
How to audit your tech stack and close the gaps
As a restaurant owner, the best first step to take when auditing your tech stack is to simply lay out all software and hardware. You need to create a comprehensive list of systems and connections, and map out how each of them communicate with each other. How and where does the data flow? Are there any integrations you haven’t yet set up? And, are there any manual steps that can be streamlined (such as by automating bookings)?
Crucially, you need to identify your cardholder data environment, or CDE. Look at each endpoint or environment that touches this information, and carefully vet all privileges and connections. Are there any third-party connections in place?
To avoid giving hackers access to your complete network, focus on segmenting your POS systems away from your public Wi-Fi and back-office operations. Doing so isolates threats to their own, encrypted networks where they cannot travel further.
Above all, focus on choosing and maintaining systems and devices that are PCI validated and therefore fully compliant. A reliable place to start is the PCI Security Standards Council’s list of validated products and services.
Protecting your payment data from malicious attacks and from leaking accidentally is all about being proactive. Restaurant data compliance is a rolling consideration, not a one-off task, and provided you are thorough in how you map out your systems and where card data travels, you are already well on track to becoming (and staying) compliant.
Chris Brown is a senior cybersecurity and product marketing leader with over 15 years of experience across cybersecurity, information systems auditing, product management, and marketing. As a Senior Product Marketing Manager at VikingCloud, Chris helps businesses understand how to navigate complex security challenges through solutions that support secure, uninterrupted operations and align with risk management frameworks.
