MalwareRetail & ConsumerRetailRansomwareData ExfiltratedTargetedFinancial accountPCILowContained

Cici Enterprises, LP

bd_10e69150d9e35ee7 · schema v1 · pii pii-v1

Severity

Low

Discovered

Mar 1, 2016

Filed

Jul 19, 2016

To disclose

20 weeks

Affected

Not disclosed

Linked

7 filings

Confidence

69%

Full breach record for Cici Enterprises, LP →2 incidents on file

CiCi Enterprises, LP reported a malware breach affecting POS systems at multiple restaurant locations. Malware was introduced by a hacker, potentially compromising payment card information. The breach impacted locations across multiple states, though no stores in Washington were affected. The incident was discovered in March 2016 and contained by July 2016. No specific number of affected individuals was disclosed.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 236 days

discovery → filing · 20 weeks / 140 days

Jul 9, 2015

Begins

Mar 1, 2016

Discovered

Jul 19, 2016

Filed

vs. sector median

+12 wks slower

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

New Hampshire State AGbd_0e71ce8368cd4d7d2016-07-19Verified
Montana State AGbd_7e11d4fb0a32f9a32016-07-19Verified by operator
Massachusetts State AGbd_37f639f1c4d5eb992016-07-20 · +1dVerified
Oregon State AGbd_a221bf92c125ab7d2016-07-20 · +1dVerified by operator

Show 2 more filings ↓up to 6d gap

California State AGbd_e92d6f0f92b7ed602016-07-20 · +1dVerified
South Carolina State AGbd_207ad30e77f468522016-07-25 · +6dVerified

Name: Frost Brown Todd LLC
norm: frost brown todd

Name: Cici Enterprises, LP
norm: cici enterprises
Industry: Retail & Consumerllm

Discovered: Mar 1, 2016
Breach occurred: Jul 9, 2015 – Jul 31, 2016
Undetected for: 236 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 19, 2016
Affected individuals: Not disclosed
Data types: Financial accountPCI
Data elements: Financial account number
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 100-199dexposure 100-199d
WA-stated discovery: Found while ongoing
Attack vector: Unknown
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified Attorney General of WashingtonNotified state agencies as required by the laws of the jurisdictions
Initial access: external_remote_services

During the incident: Retained a third party cyber security firm to perform a forensic analysis
Notified law enforcement and the state agencies
Informed the payment card networks
Posted notification on the homepage for Cicis website
Sent emails to potentially impacted members of Cicis loyalty program
Initiated heightened security measures
Began a restaurant by restaurant review and remediation
Changes made: Continues to monitor and upgrade systems
Threat of malware eliminated on a store by store basis
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 20 weeks(140 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

New Hampshire State AGJul 19 · first

Montana State AGJul 19 · first

Washington State AGJul 19 · first · this page

Massachusetts State AG+1d

Oregon State AG+1d

California State AG+1d

South Carolina State AG+6d

Pattern: first filing Jul 19 (NH), last Jul 25 (SC) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9633.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 19, 2016
Raw hash: 5f5d6dd44c5a4cd0391445e717ef0ff595d65d258e769374c230174618b8b235

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityFrost Brown Todd LLC

Victim entityCici Enterprises, LP

Incidentdiscovered Mar 1, 2016

Stated responseRetained a third party cyber security firm to perform a forensic analysis

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com