MalwareRetail & ConsumerRetailData ExfiltratedCustomer Data InvolvedPCIFinancial accountLowContained

The Crack Shack

bd_6d728a724c16234d · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Jan 17, 2020

To disclose

—

Affected

Not disclosed

Confidence

66%

Full breach record for The Crack Shack →

The Crack Shack Enterprises, LLC notified the California AG of a data breach affecting payment card information at its Encinitas, CA location. Malware installed on a payment processing server allowed unauthorized access to magnetic stripe track data (name, card number, expiration date, CVV) between August 19, 2018, and September 23, 2019. The company removed the affected server, deployed monitoring tools, and cooperated with law enforcement and card networks. No specific count of affected individuals was disclosed.

J jump to incidentP pin to compareR raw source

Incident timeline

Aug 19, 2018

Begins

Jan 17, 2020

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: The Crack Shack
norm: the crack shack
Domain: crackshack.com

Name: The Crack Shack
norm: the crack shack
Domain: crackshack.com
Industry: Retail & Consumerllm

Discovered: —
Breach occurred: Aug 19, 2018 – Sep 23, 2019
Materiality determined: —
Notification sent: Jan 17, 2020
Affected individuals: Not disclosed
Data types: PCIFinancial account
Attack vector: Unknown
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Reported to Visa, MasterCard, Discover, and American ExpressCooperated with law enforcement’s investigation into this incident

During the incident: Working with law enforcement and third-party forensic investigators to investigate this activity
Removed the affected server from its network and began using a new server
Deployed tools to monitor its network for suspicious activity
Reported to Visa, MasterCard, Discover, and American Express
Cooperated with law enforcement’s investigation into this incident
Changes made: Removed the affected server from its network and began using a new server
Deployed tools to monitor its network for suspicious activity
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-186154
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 17, 2020
Raw hash: 96f211f9200329aaf2d7cc85f688a0dbc9404f9a9ecad618b6f4f08ecb324357

Reporting entityThe Crack Shack

Victim entityThe Crack Shack

IncidentUnknown

Stated responseWorking with law enforcement and third-party forensic investigators to investigate this activity

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov