MalwareTechnologyRetail & ConsumerInformationInfostealerCapture Stored DataSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedPCIFinancial accountFinancial credentialsIdentity (basic)LowContained

North Country Business Products, Inc.

bd_2d6f3eb2fbe2ec65 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jan 4, 2019

Filed

Feb 15, 2019

To disclose

6 weeks

Affected

Not disclosed

Linked

2 filings

Confidence

64%

Full breach record for North Country Business Products, Inc. →2 incidents on file

North Country Business Products, Inc. disclosed a data security incident where malware was deployed to the POS systems of 142 business partner restaurants between January 3 and January 24, 2019. The malware collected credit and debit card information, including cardholder name, card number, expiration date, and CVV. North Country learned of suspicious activity on January 4, 2019, and engaged third-party forensic investigators. Notices were sent to affected partners and consumers starting February 1, 2019. The company is implementing additional safeguards and training.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jan 4, 2019 → Notified Feb 1, 201928d ✓ CA 60-day OK6 weeks discovery → filing

Incident timeline

undetected · 1 days

discovery → filing · 6 weeks / 42 days

Jan 3, 2019

Begins

Jan 4, 2019

Discovered

Feb 15, 2019

Filed

vs. sector median

13 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Oregon State AGbd_426708d87f004d0b2019-02-15Candidate

Name: North Country Business Products, Inc.
norm: north country business products

Name: North Country Business Products, Inc.
norm: north country business products
Industry: TechnologyllmRetail & Consumerllm

Discovered: Jan 4, 2019
Breach occurred: Jan 3, 2019 – Jan 24, 2019
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Feb 1, 2019
Affected individuals: Not disclosed
Data types: PCIFinancial accountFinancial credentialsIdentity (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1041 Exfiltration Over C2 ChannelT1195 Supply Chain Compromise
Threat actor: ExternalFinancial
Regulator citations: Notified California Attorney GeneralProviding written notice to other state regulators
Initial access: supply_chain

During the incident: Launched an investigation
Working with third-party forensic investigators
Provided written notice to business partner restaurants
Issued a media notice to prominent media outlets
Posted notice on website
Established a dedicated assistance line
Providing guidance on how to better protect against identity theft and fraud
Providing information on how to place a fraud alert and security freeze
Providing contact details for national consumer reporting agencies
Providing information on how to obtain a free credit report
Providing written notice to other state regulators
Changes made: Implementing additional safeguards
Implementing training to employees
Updated processes to further strengthen systems
Continuing to work with third-party experts to ensure highest levels of security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(42 days from discovery to filing)
Compliance flags: CA 60-day OK · 28d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jan 4, 2019
→ Notified: Feb 1, 2019
28d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jan 4, 2019 → Notified: Feb 1, 2019	28d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Oregon State AGFeb 15 · first

California State AGFeb 15 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-144733
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 15, 2019
Raw hash: 8c3db09518721711bec63ce453dcc9515b7b7a3580ce349e4dc324a5dee16e95

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityNorth Country Business Products, Inc.

Victim entityNorth Country Business Products, Inc.

Incidentdiscovered Jan 4, 2019

Stated responseLaunched an investigation

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov