HackingRetail & ConsumerRetailStolen CredentialsData ExfiltratedCustomer Data InvolvedFinancial accountLowContained

Earl Enterprises

bd_5db20cc1db6f50ac · schema v1 · pii pii-v2

Severity

Low

Discovered

—

Filed

Mar 29, 2019

To disclose

—

Affected

Not disclosed

Linked

6 filings

Confidence

66%

Full breach record for Earl Enterprises →

Earl Enterprises, operator of restaurant brands including Buca di Beppo and Planet Hollywood, notified the Washington Attorney General of a data security incident affecting payment card information. Malicious software was installed on point-of-sale systems between May 23, 2018, and March 18, 2019, capturing card numbers and expiration dates. The incident is contained, and the company engaged forensic firms and cooperated with federal law enforcement.

J jump to incidentP pin to compareR raw source

Incident timeline

May 23, 2018

Begins

Mar 29, 2019

Filed

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Delaware State AGbd_8154b69efbdf4ea12019-03-29Verified
Montana State AGbd_8800651aab8732eb2019-03-29Candidate
California State AGbd_9f22a4c0bb949c212019-03-29Verified
Oregon State AGbd_eaa8f9fe287e96752019-03-29Verified by operator

Show 1 more filing ↓up to 3d gap

South Carolina State AGbd_3d89859b63878c672019-04-01 · +3dVerified

Name: Earl Enterprises
norm: earl enterprises
Domain: earlenterprise.com

Name: Earl Enterprises
norm: earl enterprises
Domain: earlenterprise.com
Industry: Retail & Consumerllm

Discovered: —
Breach occurred: May 23, 2018 – Mar 18, 2019
Materiality determined: —
Notification sent: Mar 29, 2019
Affected individuals: Not disclosed
Data types: Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Launched an investigation
Engaged two leading cyber security firms to assist in the company’s review
Been in contact with federal law enforcement officials and is cooperating with them
Changes made: Working diligently with security experts on further remediation efforts
Continue to closely monitor its systems and take additional security measures
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Delaware State AGMar 29 · first

Montana State AGMar 29 · first

California State AGMar 29 · first

Oregon State AGMar 29 · first

Washington State AGMar 29 · first · this page

South Carolina State AG+3d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10620.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 29, 2019
Raw hash: 870e2edbd8b3ef13f23e75635e9841217d6851c3333d965b0f06a19c8c03f5d0

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityEarl Enterprises

Victim entityEarl Enterprises

IncidentUnauthorized Access

Stated responseLaunched an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com