MalwareHospitalityHospitalityRansomwareData ExfiltratedCustomer Data InvolvedPCIFinancial accountIdentity (basic)HighContained

Deli Management, Inc.

bd_49b1df9a42b8fc11 · schema v1 · pii pii-v1

Severity

High

Discovered

Dec 22, 2017

Filed

Jan 11, 2018

To disclose

20 days

Affected

3,400,000

Linked

6 filings

Confidence

67%

Full breach record for Deli Management, Inc. →3 incidents on file

Deli Management, Inc. (Jason's Deli) filed a supplemental notice to the Washington AG regarding a RAM-scraping malware breach on POS terminals. The malware operated from June 8, 2017, to December 29, 2017. The updated investigation estimates approximately 3.4 million unique payment cards were affected, exposing full track data. The incident was discovered on December 22, 2017, and consumer notifications were sent on May 18, 2018.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 197 days

discovery → filing · 20 days

Jun 8, 2017

Begins

Dec 22, 2017

Discovered

Jan 11, 2018

Filed

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

California State AGbd_0ec52a323ee32b9b2018-01-11Verified
New Hampshire State AGbd_4d7485eb2704057b2018-01-11Verified
Oregon State AGbd_864fe98185e8613f2018-01-11Verified
South Carolina State AGbd_7c535625e66137ba2018-01-16 · +5dVerified

Show 1 more filing ↓up to 132d gap

New Hampshire State AGbd_cbf566c95e6d44ca2018-05-23 · +132dVerified

Name: Deli Management, Inc.
norm: deli management
Domain: jasonsdeli.com

Name: Deli Management, Inc.
norm: deli management
Domain: jasonsdeli.com
Industry: Hospitalityllm

Discovered: Dec 22, 2017
Breach occurred: Jun 8, 2017 – Dec 29, 2017
Undetected for: 197 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 18, 2018
Affected individuals: 3,400,000nationwide
Data types: PCIFinancial accountIdentity (basic)
Data elements: NameFinancial account number
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 100-199dexposure 100-199d
WA-stated discovery: Found while ongoingContained same day
Attack vector: Unknown
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified Washington Attorney General

During the incident: Activated response plan
Engagement of a leading threat response team
Involvement of other forensic experts
Cooperation with law enforcement
Contained the breach and disabled the malware
Working to make whatever changes may be necessary to strengthen our systems against attack
Investing in advanced network monitoring capabilities
Improving our payment systems
Provided [card companies] with the information necessary to notify the banks
Changes made: Investing in advanced network monitoring capabilities
Improving our payment systems to protect the security of cardholder information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 20 days(20 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 5 states

View merged incident ↗

California State AGJan 11 · first

New Hampshire State AGJan 11 · first

Oregon State AGJan 11 · first

Washington State AGJan 11 · first · this page

South Carolina State AG+5d

New Hampshire State AG+132d

Pattern: first filing Jan 11 (CA), last May 23 (NH) — a 132-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9761.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 11, 2018
Raw hash: e092714330a931aa340cb033ac49ae39519ceef6d8e9c78e77494b5adaaf7eb7

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityDeli Management, Inc.

Victim entityDeli Management, Inc.

Incidentdiscovered Dec 22, 2017

Stated responseActivated response plan

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com