MalwareRetail & ConsumerRetailInfostealerTargetedFinancial accountCredentialsLowContained

Sully’s Superette

bd_71bfae14c5554f36 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jul 1, 2012

Filed

Jul 25, 2012

To disclose

24 days

Affected

Not disclosed

Confidence

65%

Full breach record for Sully’s Superette →

CCR Data Systems notified the NH Attorney General of a security breach at customer Sully’s Superette in Goffstown, NH. Malware on the NCR POS system captured cardholder data. The Secret Service investigated. The number of affected individuals is unknown.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 24 days

Jul 1, 2012

Discovered

Jul 25, 2012

Filed

vs. sector median

5 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: COR CCR DATA SYSTEMS, INC.
norm: cor ccr data
Domain: ccrdata.com

Name: Sully’s Superette
norm: sully s superette
Industry: Retail & Consumerllm

Discovered: Jul 1, 2012
Materiality determined: —
Notification sent: Jul 25, 2012
Affected individuals: Not disclosed
Data types: Financial accountCredentials
Attack vector: Ransomware
MITRE ATT&CK: T1056 Input CaptureT1074 Data Staged
Threat actor: ExternalFinancial
Regulator citations: US Secret Service has been involved and has done forensic work

During the incident: CCR immediately changed the PC Anywhere remote support access password
CCR staff quarantined the malware
Confirmed that the system was clean
Continues to monitor the network
Store management put procedures in place to ensure that no email or internet browsing whatsoever takes place on the POS computers
A Sonicwall router was installed to assist in segregating the POS network from the internet
The antivirus was updated
Store management also changed the access passwords for the NCR POS system
Changes made: A Sonicwall router was installed to assist in segregating the POS network from the internet
The antivirus was updated
Store management put procedures in place to ensure that no email or internet browsing whatsoever takes place on the POS computers
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 24 days(24 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/sullys-superette-20120725.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 25, 2012
Raw hash: 0d435f594b1afba75fc4f8fe5eb50c7b4b6eaf4f1dabc3226cf017d5bf4ced3e

Reporting entityCOR CCR DATA SYSTEMS, INC.

Victim entitySully’s Superette

Incidentdiscovered Jul 1, 2012

Stated responseCCR immediately changed the PC Anywhere remote support access password

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov