Most quick-service and fast-casual restaurant chains express confidence in their cybersecurity defenses despite widespread cyber incidents and data leaks, according to new research released by VikingCloud.

The survey found that 94% of restaurant leaders said they were confident or very confident in their ability to prevent or detect a cyberattack. However, 80% said their organizations experienced at least one cyber incident during the past 12 months, while 76% reported sensitive data was leaked during that period.

Among the types of information exposed were payment card data (40%), customer personal information (32%), internal system credentials (30%) and employee payroll records (30%). More than one-third of respondents also said they initially mistook a real cyberattack for a routine technical issue.

The report also found that only 36% of restaurant chains have 24/7 monitoring, standardized security controls and tested incident response plans across all locations. In addition, 38% reported inconsistent security practices among locations with varying levels of IT maturity, while 28% said they lack real-time centralized visibility into their security posture.

According to the research, 78% of restaurant leaders delay security patches to avoid disrupting operations, with 28% saying they do so frequently. Forty-four percent said employees prioritize speed over security protocols.

Third-party vendors also remain a significant concern. Sixty-two percent of restaurant chains work with six or more third-party vendors at each location, while 38% said that reliance increases their cybersecurity risk. Twenty-eight percent reported third-party platform data was exposed during the past year.

The report found that 54% of restaurants operate between 26 and 99 connected IoT devices at each location. Forty percent already use AI-powered drive-thru or voice ordering systems and 18% reported experiencing brand damage related to AI drive-thru technology hallucinations.

Social engineering attacks were also common. Eighty percent of respondents reported experiencing at least one such attack during the past year, including fraudulent refund requests (36%), phishing attacks targeting employee credentials (36%) and AI-generated voice or video impersonations of executives used to authorize fraudulent payments (30%). Thirty-six percent said they feel either not at all prepared or only somewhat prepared to respond to a socially engineered deepfake voice or video attack.

VikingCloud’s "Cyber Risk, Supersized: The 2026 QSR & Fast Casual Restaurant Report" is based on a quantitative survey of security leaders, IT leaders and franchise owners at quick-service and fast-casual restaurant chains across the United States and Canada.