DisclosureLens
MalwareRetail & ConsumerRetailRansomwareData ExfiltratedCustomer Data InvolvedSupply Chain (3P Vendor)Financial accountPIILowContained

THE WENDY'S COMPANY

bd_0cb8339e139fc8ed · schema v1 · pii pii-v1

Severity

Low

Discovered

Feb 1, 2016

Filed

Jul 7, 2016

To disclose

22 weeks

Affected

Not disclosed

Linked

4 filings

Confidence

66%
Full breach record for THE WENDY'S COMPANY →5 incidents on file

The Wendy's Company reported malicious cyber activity targeting payment card information at franchise locations in the US and Canada. The incident involved malware installed on point-of-sale systems via compromised service provider credentials. Wendy's disabled the malware and offered one year of fraud consultation and identity restoration services to affected customers.

Incident timeline

discovery → filing · 22 weeks / 157 days

Feb 1, 2016

Begins

Feb 1, 2016

Discovered

Jul 7, 2016

Filed

vs. sector median

+13 wks slower

This filing is one of 4 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Filing propagation · 4 filings · 4 states

View merged incident ↗
South Carolina State AG+2d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.