Your POS vendor is your attack surface

The cash register is no longer entirely yours. The software that takes your guests' payment is built, patched and partly hosted by a vendor, wired into your network along paths you do not control, and connected to payment processing that runs through infrastructure you never see. Two documented episodes, Clop listing Toast in August 2026 and Fullsteam filing breach notices in December 2025, make the point without any need for drama: the risk now enters a hotel through its point-of-sale (POS) vendor.

Toast and the Clop wave: an intrusion the vendor confirmed

On August 12, 2026, the Clop ransomware gang listed toasttab.com on its leak site, one of some forty companies named in mid-August. The campaign exploited a critical flaw (CVE-2026-12569) in the PTC Windchill and FlexPLM product lifecycle management platforms, actively exploited and added to CISA's known exploited vulnerabilities catalog in June. The link between industrial design software and a restaurant POS platform is not obvious, and that is exactly the lesson.

A leak-site claim is not evidence. Toast, however, confirmed it. "Toast identified unauthorized access to a limited number of files; to date, the files identified contain nonsensitive internal documents. We isolated the affected systems the same day we detected the activity, and the situation has been contained," spokesperson Allie Rosenberg told Information Security Media Group, adding that no customer data was affected. Toast was among the few companies named in that wave to comment quickly and on the record.

For a hotel running a restaurant on Toast, the confirmation is a reminder of where the perimeter sits. The attack surface is the vendor's whole company, not just the module you license. One neglected tool left exposed somewhere in its environment is enough to put your checkout system's name in the headlines.

Availability is part of the contract too

Intrusion is not the only exposure, and Toast's public status page documents the other one: fourteen incidents published between August 13 and October 27, 2026. Among them an outage affecting the Toast POS app and the Toastweb back office on October 3, a "Catering Payment Failures" incident on October 7, and two deposit incidents on October 4 and 5. None of these episodes involved data. Each one involved the ability to take payment and get paid.

A POS contract therefore has to be negotiated on availability and history, not confidentiality clauses alone. The status page is that history, kept by the vendor itself. Subscribing to it is the first act of due diligence, and the simplest.

Fullsteam: skimming code inside a vendor's modules

On December 15, 2025, Fullsteam Software Holdings LLC, doing business as Event Rental Systems, filed breach notices with U.S. state attorneys general, including California. The notice is specific: unauthorized code was "inserted into certain modules of some customer websites", designed to harvest payment card data during transactions. Names, contact details, card numbers, CVVs and expiration dates were scraped between October 2024 and October 2025, the notice says, while Social Security numbers and bank accounts were not affected. The code was removed, a forensic firm engaged, law enforcement and the card brands notified.

The nuance matters. The notice covers Event Rental Systems, the group's event rental software brand, and nothing in it states that the Silverware POS platform itself was compromised. But Fullsteam is the parent of Silverware POS and Arryved, two hospitality POS platforms, and Silverware's sale materials describe established relationships with major hotel chains. For a hotel running Silverware, a notice filed under the parent's name still concerns it: group security history is shared, and it is the kind of history no sales deck summarizes on its own. The exact number of affected individuals is not disclosed in the public notices.

Why this lands on your desk

Your POS vendor holds three things you do not control: the code it deploys on your terminals, the network path between your registers and the payment processor, and an update pipeline through which an intrusion can travel down to the receipt printer. Oracle Simphony, deployed in many hotels, made the same point differently in the advisory published on this site on November 2: six flaws exploitable without authentication across builds 19.8 to 19.10.1, one with a public proof of concept, and a basic question few properties can answer: which exact build runs on which terminal, patched or not.

Five written questions for every POS vendor

1. Which exact software build runs at our property, what is its patch status, and on what upgrade schedule. "You are up to date" without a build number is not an answer.
2. What is your breach history, including incidents at your parent company and sister brands. The Fullsteam notice covers one brand of a group that runs dozens.
3. Are the POS admin interfaces and HTTP services reachable from guest Wi-Fi, a conference VLAN or the internet. Ask for firewall rules as evidence, not intent.
4. Which status page should our teams subscribe to, and what is your incident disclosure policy.
5. Within what contractual timeframe will you notify us of a security event affecting our data or the service, and can you provide your latest PCI DSS (Payment Card Industry Data Security Standard) attestation of compliance.

Five written answers will tell you more about your real exposure than any certification brochure. The next advisory on this site, coming soon, will cover the hygiene of your own internal network.