Duffy's Sports Grill

Duffy's Sports Grill, a Florida restaurant chain headquartered in Lake Worth, appears to have been hit by a ransomware attack in March 2026, according to multiple independent trackers and local reporting. The Qilin ransomware group listed the company, whose website is duffysmvp.com, on its extortion site on March 14, a listing first spotted by Ransomware.live. Around the same time, customers reported that card payments and the chain's MVP loyalty program stopped working at multiple locations, and some restaurants went cash-only for days. The investigation team has indexed roughly 24,354 records tied to the incident, including names, phone numbers, and Social Security numbers. Duffy's has not publicly confirmed the attack, and it is not yet known exactly how many individuals were affected.

Limited public reporting: As of September 25, 2026, detailed company notices or major news coverage for this listing were limited in sources reviewed. The facts below rely primarily on the indexed fields plus any secondary sources cited.

Breach Timeline

March 13, 2026: Social media posts reviewed by DysruptionHub suggest Duffy's system problems were already visible, with customers reporting cash-only service, loyalty point issues, canceled events, and at least one temporary closure.

March 14, 2026: The Qilin group listed Duffy's Sports Grill on its extortion site, a listing first spotted by Ransomware.live.

March 24, 2026: The Boca Raton Tribune reported that card-processing problems had lasted for days, that the MVP rewards program was disrupted, and that at least one location manually wrote down customer card information so charges could be processed later. The chain reportedly did not respond before publication.

What Information Was Compromised?

Our analysis found the following data types in this breach: 24,354 names, 10,105 phone numbers, 8,182 email addresses, 2,910 Social Security numbers, 393 birthdays, and 80 street addresses.

Not every individual is affected by every type of data listed here.

What Are the Potential Risks for Affected Individuals?

The presence of Social Security numbers is the most serious concern. Combined with names, birthdays, and contact details, that information is enough for criminals to attempt identity theft, open fraudulent accounts, or file fake tax returns. Phone numbers and email addresses are commonly used for phishing: attackers may pose as Duffy's, a bank, or a credit bureau to trick people into handing over more information or payment card details. Anyone who dined at a location that manually recorded card information during the outage should also watch their statements for unauthorized charges, though no public reporting has confirmed card misuse tied to the incident as of September 25, 2026.

What Should You Do If You Were Affected?

If you believe your information was exposed, take these steps:

Place a free fraud alert or security freeze with the three major credit bureaus, Equifax, Experian, and TransUnion. A freeze blocks most new credit from being opened in your name.

Review your credit reports at annualcreditreport.com for accounts you did not open.

Monitor bank and card statements, especially if you visited a Duffy's location during the mid-March payment disruptions.

Be skeptical of unexpected calls, texts, or emails referencing Duffy's, its MVP rewards program, or a breach, and never share your Social Security number or passwords in response.

If you reused a password tied to your Duffy's MVP account, change it anywhere else it was used.

Because Duffy's has not issued a public notice, affected individuals should watch the company's website and Florida news outlets for confirmation, notification letters, or credit monitoring offers.