MalwareRetail & ConsumerRetailCustomer Data InvolvedPCIFinancial accountFinancial credentialsIdentity (basic)LowActive

Brinker International, Inc.

bd_139b47a6cdc629a5 · schema v1 · pii pii-v1

Severity

Low

Discovered

May 11, 2018

Filed

May 18, 2018

To disclose

7 days

Affected

Not disclosed

Linked

5 filings

Confidence

65%

Full breach record for Brinker International, Inc. →3 incidents on file

Brinker International, Inc. (Chili's Grill & Bar) disclosed that malware was used to gather payment card information (card numbers, names, potentially expiration dates and CVV codes) from in-restaurant purchases at certain locations between March and April 2018. The company learned of the incident on May 11, 2018. The investigation is ongoing, and the total number of affected individuals is unknown. Free credit monitoring and fraud resolution services are being offered.

J jump to incidentP pin to compareR raw source

California clockDiscovered May 11, 2018 → Notified May 18, 20187d ✓ CA 60-day OK7 days discovery → filing

Incident timeline

undetected · 71 days

discovery → filing · 7 days

Mar 1, 2018

Begins

May 11, 2018

Discovered

May 18, 2018

Filed

vs. sector median

7 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Washington State AGbd_a82baac3ee11c1292018-05-18Verified
New Hampshire State AGbd_e5cbf4dfc3b877672018-05-18Verified
Montana State AGbd_f0a4501e416696002018-05-18Verified
Massachusetts State AGbd_4bf71a3b6beef6872018-05-21 · +3dVerified

Name: Brinker International, Inc.
norm: brinker international
Domain: brinker.com

Name: Brinker International, Inc.
norm: brinker international
Domain: brinker.com
Industry: Retail & Consumerllm

Discovered: May 11, 2018
Breach occurred: Mar 1, 2018 – Apr 30, 2018
Undetected for: 71 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 18, 2018
Affected individuals: Not disclosed
Data types: PCIFinancial accountFinancial credentialsIdentity (basic)
Attack vector: Unknown
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: Notified law enforcement

During the incident: Activated our response plan upon learning of this incident
Working with third-party forensic experts to conduct an investigation
Notified law enforcement of this incident
Offering free fraud resolution and credit monitoring services through ID Experts
Changes made: Working with third-party forensic experts to identify additional safeguards which may be utilized to secure data
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 days(7 days from discovery to filing)
Compliance flags: CA 60-day OK · 7d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: May 11, 2018
→ Notified: May 18, 2018
7d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: May 11, 2018 → Notified: May 18, 2018	7d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Washington State AGMay 18 · first

New Hampshire State AGMay 18 · first

Montana State AGMay 18 · first

California State AGMay 18 · first · this page

Massachusetts State AG+3d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-136377
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 18, 2018
Raw hash: 31d19711bd54959b6a826329d14eed126d6d2a7b00a75aadbfdadb12fa3642b4

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityBrinker International, Inc.

Victim entityBrinker International, Inc.

Incidentdiscovered May 11, 2018

Stated responseActivated our response plan upon learning of this incident

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov