Social EngineeringProfessional ServicesProfessional ServicesPhishingStolen CredentialsData ExfiltratedTargetedPIIIdentity (basic)LowContained

NATIONAL RESTAURANT ASSOCIATION

bd_3e57f3822a6e4de7 · schema v1 · pii pii-v1

Severity

Low

Discovered

Oct 2, 2017

Filed

Jun 14, 2018

To disclose

36 weeks

Affected

6state residents only

Linked

3 filings

Confidence

66%

Full breach record for NATIONAL RESTAURANT ASSOCIATION →

National Restaurant Association notified individuals of a data breach where employee email accounts were compromised via suspicious emails identified on Oct 2, 2017. Unauthorized logins occurred around Nov 28, 2017. Personal information may have been impacted. The Association engaged forensic investigators and offered one year of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 36 weeks / 255 days

Oct 2, 2017

Discovered

Jun 14, 2018

Filed

vs. sector median

+18 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

New Hampshire State AGbd_514a4cefec40f2372018-04-30 · +45dCandidate
Massachusetts State AGbd_d2c14fe70881b7922018-04-30 · +45dVerified

Name: NATIONAL RESTAURANT ASSOCIATION
norm: national restaurant

Name: NATIONAL RESTAURANT ASSOCIATION
norm: national restaurant
Industry: Professional Servicesllm

Discovered: Oct 2, 2017
Materiality determined: —
Notification sent: Apr 20, 2018
Affected individuals: 6state-resident count only
Data types: PIIIdentity (basic)
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: External
Initial access: phishing_link

During the incident: Worked with leading third-party forensic investigators
Offering access to one year of credit monitoring and identity restoration services
Changes made: Reviewing existing policies and procedures
Implementing additional safeguards that further secure the information in our systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 36 weeks(255 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

New Hampshire State AGApr 30 · first

Massachusetts State AGApr 30 · first

Montana State AG+45d · this page

Pattern: first filing Apr 30 (NH), last Jun 14 (MT) — a 45-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/National-Restaurant-Association-1.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 14, 2018
Raw hash: 1f6e9c9f3fda75d87dc2aca481927fa296304294d653e76dd48f9abbdefc0159

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityNATIONAL RESTAURANT ASSOCIATION

Victim entityNATIONAL RESTAURANT ASSOCIATION

Incidentdiscovered Oct 2, 2017

Stated responseWorked with leading third-party forensic investigators

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov