MalwareRetail & ConsumerRetailSkimmerSupply Chain (3P Vendor)Customer Data InvolvedFinancial accountFinancial credentialsLowContained

LYFE Kitchen Companies, LLC

bd_675c168752664299 · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Mar 21, 2017

To disclose

—

Affected

Not disclosed

Confidence

66%

Full breach record for LYFE Kitchen Companies, LLC →

LYFE Kitchen Companies, LLC experienced a data breach involving malware on a third-party POS vendor's network. The malware was programmed to access data from the magnetic stripe of payment cards (card number, expiration date, verification code) at five corporate restaurants in California, Tennessee, and Nevada between November 2, 2016, and January 6, 2017. The malware has been removed. No evidence suggests data was exported. Complimentary credit monitoring is offered.

J jump to incidentP pin to compareR raw source

Incident timeline

Nov 2, 2016

Begins

Mar 21, 2017

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: LYFE Kitchen Companies, LLC
norm: lyfe kitchen companies

Name: LYFE Kitchen Companies, LLC
norm: lyfe kitchen companies
Industry: Retail & Consumerllm

Discovered: —
Breach occurred: Nov 2, 2016 – Jan 6, 2017
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Financial accountFinancial credentials
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Threat actor: ExternalFinancial
Third party: via third-party point of sale (POS) vendor
Initial access: supply_chain

During the incident: Notified federal law enforcement
Retained a third-party IT security expert to conduct an investigation
Confirmed that all malware was removed and eradicated from all affected POS equipment
Providing complimentary credit monitoring for one year to all customers who used a payment card at a potentially affected restaurant
Changes made: Further strengthen the data security measures of our vendors
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-67060
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 21, 2017
Raw hash: cf3c678b6a73d1d3137f13062db3ae6f181e82cdee71d57937e8e32f86783114

Reporting entityLYFE Kitchen Companies, LLC

Victim entityLYFE Kitchen Companies, LLC

IncidentThird-Party / Supply Chain

Stated responseNotified federal law enforcement

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov