NOTICE OF PAYMENT CARD INCIDENT

Catch Hospitality Group takes the security of payment card data very seriously. We are notifying customers of Catch NYC (including Catch Roof) and Catch Steak about an incident involving payment cards that we recently identified and addressed. This notice explains the incident, measures we have taken, and some steps you can take in response.

Catch recently launched an investigation after detecting unauthorized activity on some of our payment processing systems, and a leading cybersecurity firm was engaged to assist. The investigation identified the operation of malware designed to access payment card data from cards used on certain point-of-sale (“POS”) devices at Catch NYC (including Catch Roof) and Catch Steak. The malware searched for track data (which sometimes has the cardholder name in addition to card number, expiration date, and internal verification code) read from a payment card as it was being routed through these POS devices. There is no indication that other customer information was accessed.

Catch NYC and Catch Steak use two different POS devices – one that is brought by the waitstaff to a table and another at the bar and areas where dining area waitstaff enter orders for the kitchen. Almost all of the dining area transactions occur on devices brought to a guest at the table. Those transactions were not involved in this incident because those devices use point-to-point encryption technology. The cards involved in this incident are cards used at the bar or in the rare circumstances that a card was swiped at the device where waitstaff enter orders. The specific timeframes when payment card data may have been accessed by the malware vary between the two locations. For Catch NYC (including Catch Roof), the timeframe was from March 19, 2019 through October 17, 2019. For Catch Steak, the timeframe was September 17, 2019 through October 17, 2019.

During the investigation, we removed the malware and implemented enhanced security measures, and we continue to work with cybersecurity experts to evaluate additional ways to enhance the security of payment card data. In addition, we have reported the incident to our payment processor and are supporting an investigation by law enforcement.

It is always advisable to review your payment card statements for any unauthorized activity. You should immediately report any unauthorized charges to your card issuer because payment card rules generally provide that cardholders are not responsible for unauthorized charges reported in a timely manner. The phone number to call is usually on the back of your payment card. Please see the section below for information on additional steps you may take.

If you have additional questions, you can call 833-947-1416 Monday through Friday between the hours of 9:00 a.m. and 9:00 p.m. EST.

ADDITIONAL STEPS YOU CAN TAKE

It is always advisable to be vigilant for incidents of fraud or identity theft by reviewing your account statements and free credit reports for any unauthorized activity. You may obtain a copy of your credit report, free of charge, once every 12 months from each of the three nationwide credit reporting companies. To order your free annual credit report, please visit www.annualcreditreport.com or call toll free at 1-877-322-8228. Contact information for the three nationwide credit reporting companies is as follows:

Equifax, PO Box 740241, Atlanta, GA 30374, www.equifax.com, 1-800-685-1111

Experian, PO Box 2002, Allen, TX 75013, www.experian.com, 1-888-397-3742

TransUnion, PO Box 2000, Chester, PA 19016, www.transunion.com, 1-800-916-8800

If you believe you are the victim of identity theft or have reason to believe your personal information has been misused, you should immediately contact the Federal Trade Commission and/or the Attorney General’s office in your state. You can obtain information from these sources about steps an individual can take to avoid identity theft as well as information about fraud alerts and security freezes. You should also contact your local law enforcement authorities and file a police report. Obtain a copy of the police report in case you are asked to provide copies to creditors to correct your records. Contact information for the Federal Trade Commission and the New York Attorney General is as follows:

Federal Trade Commission, Consumer Response Center, 600 Pennsylvania Avenue, NW Washington, DC 20580, 1-877-IDTHEFT (438-4338), www.ftc.gov/idtheft

New York State Office of the Attorney General, The Capitol, Albany, NY 12224-0341, 1-800-771-7755, https://ag.ny.gov/