The Aloha POS is used by 140,000 outlets worldwide, including the likes of Brewdog, Dunkin Donuts, Gaucho, Nandos and other franchises. The BlackCat/ALPHV gang has claimed credit for the outage in a short-lived post on data leak site eCrime.ch, writing: "During four days of silence and removal of any mention of ransomware on reddit, NCR representatives went into a chat room to find out what data had been stolen. After receiving information that NCR data had not been stolen, but accessed their customers’ networks, they decided to make a press release. We are forced to take action regarding NCR customers. If you become our victim you know who to thank." NCR says it has notified customers of the breach and engaged outside experts to contain the incident and begin the recovery process.

The firm says that in-restaurant purchases and transactions continue to operate, affected customers have reduced capabilities on specific Aloha cloud-based and Counterpoint functionality that has impacted their ability to manage restaurant administrative functions. "We believe this incident is limited to specific functionality in Aloha cloud-based services and Counterpoint," states NCR. "At this time, our ongoing investigation also indicates that no customer systems or networks are involved. None of our ATM, digital banking, payments, or other retail products are processed at this data center."