HackingRetail & ConsumerRetailBackdoor / C2TargetedFinancial accountPIIMediumContained

O'Charley's Restaurant and Bar

bd_5a8aee170786b3f8 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 8, 2016

Filed

May 23, 2016

To disclose

6 weeks

Affected

40,590state residents only

Confidence

64%

Full breach record for O'Charley's Restaurant and Bar →

O’Charley’s disclosed a payment card incident where an unauthorized program on POS devices captured magnetic stripe data (cardholder name and number) from March 18 to April 8, 2016. The company engaged a third-party cyber-security firm, notified law enforcement and card networks, and is strengthening system security. No other guest information was involved.

J jump to incidentP pin to compareR raw source

South Carolina clock✓ SC CRA notice due6 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 21 days

discovery → filing · 6 weeks / 45 days

Mar 18, 2016

Begins

Apr 8, 2016

Discovered

May 23, 2016

Filed

vs. sector median

3 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed40,590 affectedView incident

Name: O'Charley's Restaurant and Bar
norm: o charley s restaurant and bar
Domain: ocharleys.com

Name: O'Charley's Restaurant and Bar
norm: o charley s restaurant and bar
Domain: ocharleys.com
Industry: Retail & Consumerllm

Discovered: Apr 8, 2016
Breach occurred: Mar 18, 2016 – Apr 8, 2016
Undetected for: 21 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 20, 2016
Affected individuals: 40,590state-resident count only
Data types: Financial accountPII
Attack vector: Unauthorized Access
MITRE ATT&CK: T1052 Exfiltration Over Physical MediumT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Notified law enforcement officials
Initial access: exploit_public_facing

During the incident: Engaged a leading third party cyber-security firm to assist
Notified law enforcement officials and are supporting their investigation
Notified the payment card networks
Changes made: Work with the third-party cyber security firm to further strengthen the security of our systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(45 days from discovery to filing)
Compliance flags: SC CRA notice due
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2016/O'Charley's.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 23, 2016
Raw hash: b9ec75b8079f2a2ac429c1862718f8207f2f1c26bdc6dfce37220755db74247c

Reporting entityO'Charley's Restaurant and Bar

Victim entityO'Charley's Restaurant and Bar

Incidentdiscovered Apr 8, 2016

Stated responseEngaged a leading third party cyber-security firm to assist

ComplianceSC CRA notice due

Extraction provenanceno artifact recorded

Source provenanceconsumer.sc.gov