A Puyallup restaurant was attacked by cyber extortionists. The public helped it fight back

At first it was just a single one-star review on Facebook.

Then, another one-star review posted. And another. They started at the beginning of May, a few months after Napoli Italiano and Speakeasy Lounge opened in South Hill.

“The fettuccine Alfredo tasted like it came from a jar,” one said.

“Went in to try the new restaurant, waited about 20 minutes. Never got served. Left. Shame,” read another.

It would take weeks to put together that the restaurant was under attack by what appeared to be cyber extortionists. The restaurant flew into damage control to see if it could salvage its online reputation, alerting its customers of the scam and notifying the company that hosts its website.

Its efforts seem to be paying off, but it was a lot of work and worry.

Johnny Bristol owns Briscom, the company Napoli Italiano contracts for its marketing.

“It happened so fast, I didn’t know if I should turn them (the reviews) off. I replied back to them because I read the best way to combat (bad reviews) is to reply back to them so that everybody knows they’re not real,” Bristol said recently. “I replied and replied and replied back to them, and none of the profiles replied back.”

The reviews carried odd tidbits that weren’t true. One noted the restaurant had a “beautiful” view. It doesn’t. It’s a strip-mall restaurant with a view of a parking lot. Another described the restaurant as being in the metro Portland area. It’s just up the hill from Puyallup.

The owners and the restaurant’s social media manager grew increasingly skeptical as they researched the profiles posting them.

Research by The News Tribune found that the majority of the one-star reviewers used stock photographs or what appeared to be “borrowed” images, and the profiles carried sparse personal details. Of 16 profiles reviewed by The News Tribune, 15 had something in common. Each had a one-star review of Napoli Italiano, but no other reviews credited to the profiles.

Next came a flood of traffic to the restaurant’s website, which crashed it. Bristol spoke with the website host who sent him a report that suggested a denial of service (or DDoS) attack. The report, provided to the News Tribune, indicated the traffic was launched from Europe.

“I thought it was crazy, why are they attacking a little Italian restaurant?” wondered Bristol.

He soon found out why.

A demand came via message: Give us $900 and those negative reviews will flip to positive reviews, read the demand. Bristol thought it odd that after all that work to malign the business, all the extortionists wanted was $900. Owner Ramesh Kumar refused to pay.

“They’ll just put more reviews up,” he told Bristol.

Bristol took several measures to help protect the business.

He worked with the website host to add a filter to thwart another attack. He changed the restaurant’s Facebook settings, too.

“I went on Facebook, and you can block countries outside of the U.S. from reviewing, so I blocked them and it pretty much stopped them, but there were so many by then, 20 or 30 by then,” Bristol said. “They’ve got people over the barrel, pretty much, because these review sites, it’s in favor of the customers, not the restaurants; so they’ve figured out how to take advantage of that.”

Bristol said the restaurant and its staff felt powerless, so they decided to fight back with the court of public opinion. They posted about the attack on the restaurant’s Facebook page, prompting news coverage that included an appearance on the Dori Monson show.

The restaurant learned its best weapon in fighting the attack is the public.

“This outpouring of support from customers for Napoli is really the key to mounting a comeback against this kind of devastating attack,” Bristol said.

The restaurant’s fans and strangers who heard about the attack have posted high ratings to offset the one-star reviews, he said.

As of Tuesday, the restaurant’s rating was above four stars. Additionally, Facebook and Google users have reported the profiles on behalf of the restaurant. One profile is under review, said Bristol, but as of Tuesday, most of the suspicious looking one-star reviews were still up and so were the profiles.

Professors and instructors with the University of Washington Tacoma’s Master of Cybersecurity and Leadership (MCL) program and other technology instructors agree with the steps the restaurant took, such as alerting the website host and the public to let them know the restaurant is being scammed.

“Ask loyal customers to balance their reviews, give them a coupon,” suggested UWT technology professor Bryan Goda. Indeed, the restaurant is throwing a pizza party to encourage locals to post positive reviews.

UWT professor Anderson Nascimento said he’s seen extortion attempts, but this is the first time he’s heard of a coordinated effort of negative social media reviews coupled with a DDoS. Nascimento also suggested Napoli, or any other business under similar attack, should report the attack to the police, something Bristol said the restaurant had not yet done.

UWT lecturer DC Grant recommended starting with the FBI’s Seattle field office.

“Law enforcement can cooperate with Interpol to take down the botnet and arrest the people responsible for the attack,” said Nascimento. “They should also notify Yelp and Facebook that they are under attack and receiving fake reviews. Do not communicate with the attackers at all.”

Napoli Italiano and Speakeasy Lounge

Where: 10312 120th St. E., Puyallup

Info: 253-446-7016 or napoliitalianopuyallup.com

This story was originally published July 24, 2018 at 10:00 AM.