HackingRetail & ConsumerRetailCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDFinancial accountPHICredentialsMediumContained

Tavistock Restaurants Upscale Group Holdings, LLC

bd_2aaf8bd6b7a80f7b · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 6, 2022

Filed

Oct 4, 2022

To disclose

26 weeks

Affected

6state residents only

Linked

3 filings

Confidence

66%

Full breach record for Tavistock Restaurants Upscale Group Holdings, LLC →

Tavistock Restaurants Upscale Group Holdings, LLC notified the NH Attorney General of a data security incident detected on April 6, 2022. An unauthorized individual accessed corporate network files containing personal data of approximately 6 New Hampshire residents. Affected data included names, SSNs, driver's license/passport numbers, payment card/financial account info, health insurance IDs, and email credentials. The company contained the access, engaged forensic experts, and implemented MFA and enhanced monitoring. Identity monitoring services were provided via Kroll.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 26 weeks / 181 days

Apr 6, 2022

Begins

Apr 6, 2022

Discovered

Oct 4, 2022

Filed

vs. sector median

+18 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Maine State AGbd_5f438ec3b517b6682022-10-03 · +1dCandidate
Massachusetts State AGbd_9b245f63af5677782022-10-10 · +6dVerified

Name: Tavistock Restaurants Upscale Group Holdings, LLC
norm: tavistock restaurants upscale

Name: Tavistock Restaurants Upscale Group Holdings, LLC
norm: tavistock restaurants upscale
Industry: Retail & Consumerllm

Discovered: Apr 6, 2022
Breach occurred: Apr 6, 2022
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 29, 2022
Affected individuals: 6state-resident count only
Data types: Identity (basic)Government IDFinancial accountPHICredentials
Attack vector: Unknown
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified New Hampshire Attorney General

During the incident: Conducted a thorough forensic analysis and investigation
Contained, and eliminated the unauthorized individual's(s') access to its systems
Engaged a cybersecurity firm to assist with investigating the nature and scope of the incident
Removed access to all systems in our data center and secured the network
Established a dedicated call center service to assist affected residents
Changes made: Implemented additional security measures to further fortify its network’s security measures and protocols
Enhancing administrative and technical safeguards
Expanding the use of multi-factor authentication
More frequent and rigorous training of employees on avoiding phishing attempts
Additional filtering of malicious links and impersonation protection policies
Enhancing network monitoring
Offering complimentary access to 12 months of identity theft protection services through Kroll Essential Monitoring Services
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 26 weeks(181 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Maine State AGOct 3 · first

New Hampshire State AG+1d · this page

Massachusetts State AG+7d

Pattern: first filing Oct 3 (ME), last Oct 10 (MA) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/tavistock-restaurants-upscale-group-holdings-20221004.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 4, 2022
Raw hash: 71c5782f0ac79428824595c716948c690d62456f9932abc6869d9c9f3a6547b6

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityTavistock Restaurants Upscale Group Holdings, LLC

Victim entityTavistock Restaurants Upscale Group Holdings, LLC

Incidentdiscovered Apr 6, 2022

Stated responseConducted a thorough forensic analysis and investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov