HackingRetail & ConsumerRetailCustomer Data InvolvedIdentity (basic)Government IDMediumContained

U.S. Restaurants, Inc.

bd_12e4fc2557a4bd7b · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 15, 2020

Filed

Jul 21, 2020

To disclose

5 weeks

Affected

12state residents only

Linked

4 filings

Confidence

67%

Full breach record for U.S. Restaurants, Inc. →

U.S. Restaurants, Inc. notified Montana and Rhode Island residents of a cyberattack resulting in unauthorized access to files containing names and Social Security numbers. The company secured systems, engaged forensic investigators, and offered one year of Experian IdentityWorks credit monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 5 weeks / 36 days

Jun 15, 2020

Discovered

Jul 21, 2020

Filed

vs. sector median

4 wks faster

This filing is one of 4 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_65f20711dafeedd22020-07-21Verified
Indiana State AGbd_70e58d495941d2b82020-07-21Verified
New Hampshire State AGbd_b21078295a6ef6522020-07-21Verified

Name: U.S. Restaurants, Inc.
norm: us restaurants

Name: U.S. Restaurants, Inc.
norm: us restaurants
Industry: Retail & Consumerllm

Discovered: Jun 15, 2020
Materiality determined: —
Notification sent: —
Affected individuals: 12state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Initial access: exploit_public_facing

During the incident: Launched an internal investigation
Secured our systems to prevent potential further access
Retained a leading forensic security firm to investigate the incident
Offering a complimentary one-year membership of Experian IdentityWorksSM Credit 3B
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(36 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Massachusetts State AGJul 21 · first

Indiana State AGJul 21 · first

New Hampshire State AGJul 21 · first

Montana State AGJul 21 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/US-Restaurants-Consumer-ltr.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 21, 2020
Raw hash: 53220a812bc30876b7c2e2d70223f582ce775b973181b20aab3ff4cf368d2bf1

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityU.S. Restaurants, Inc.

Victim entityU.S. Restaurants, Inc.

Incidentdiscovered Jun 15, 2020

Stated responseLaunched an internal investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov