HackingRetail & ConsumerRetailSQL InjectionStolen CredentialsData ExfiltratedCustomer Data InvolvedTargetedIdentity (basic)Financial accountFinancial credentialsLowContained

Barbecue Renew

bd_42d4910a2813154b · schema v1 · pii pii-v1

Severity

Low

Discovered

Oct 1, 2014

Filed

Jan 16, 2015

To disclose

15 weeks

Affected

416state residents only

Linked

3 filings

Confidence

66%

Full breach record for Barbecue Renew →

Barbecue Renew, Inc. notified the NH Attorney General of a data breach affecting 416 NH residents. Between Jan-Oct 2014, an SQL injection attack exposed cardholder data (names, addresses, card numbers, CVVs). Discovery occurred in Oct 2014 via bank fraud notifications. Response included forensic investigation, law enforcement notification, and 1 year of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 273 days

discovery → filing · 15 weeks / 107 days

Jan 1, 2014

Begins

Oct 1, 2014

Discovered

Jan 16, 2015

Filed

vs. sector median

+7 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

California State AGbd_d5f550d53b50ae432015-01-16Candidate
Massachusetts State AGbd_4dde69af1ac4170e2015-01-20 · +4dVerified

Name: Nelson Mullins Riley & Scarborough LLP
norm: nelson mullins riley scarborough

Name: Barbecue Renew
norm: barbecue renew
Industry: Retail & Consumerllm

Discovered: Oct 1, 2014
Breach occurred: Jan 1, 2014 – Oct 1, 2014
Undetected for: 273 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 23, 2015
Affected individuals: 416state-resident count only
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney GeneralProvided final investigative report to card brands and Bank of America
Initial access: exploit_public_facing

During the incident: Notified law enforcement
Engaged a third party forensic investigator to conduct a comprehensive review of its security environment
Remedied the vulnerability by removing or fixing vulnerable web pages
Provided 1-year of free credit monitoring services through Kroll
Changes made: Enhancing information security policies and procedures
Improving privacy, security, and related risk management programs
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 15 weeks(107 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

California State AGJan 16 · first

New Hampshire State AGJan 16 · first · this page

Massachusetts State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/barbecue-renew-20150116.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 16, 2015
Raw hash: 5328c15858afd4f97a77e1eff6ec2b1bb644c7d3602876d172f302fe7c1d7bc0

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityNelson Mullins Riley & Scarborough LLP

Victim entityBarbecue Renew

Incidentdiscovered Oct 1, 2014

Stated responseNotified law enforcement

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov