MalwareRetail & ConsumerRetailRansomwareData EncryptedPCIFinancial accountPIILowContained

PrimoHoagies Franchising, Inc.

bd_7a9e245e5d4f2b6e · schema v1 · pii pii-v1

Severity

Low

Discovered

Feb 18, 2020

Filed

Apr 16, 2020

To disclose

8 weeks

Affected

9state residents only

Linked

5 filings

Confidence

65%

Full breach record for PrimoHoagies Franchising, Inc. →

PrimoHoagies Franchising, Inc. disclosed a malware incident affecting online payment card data. Unauthorized access occurred between July 15, 2019, and February 18, 2020. Affected data included names, addresses, card numbers, expiration dates, and security codes. The company engaged cybersecurity firms, notified law enforcement and card brands, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 218 days

discovery → filing · 8 weeks / 58 days

Jul 15, 2019

Begins

Feb 18, 2020

Discovered

Apr 16, 2020

Filed

vs. sector median

+1 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Indiana State AGbd_af7a1c1f2f3480122020-04-17 · +1dVerified
Delaware State AGbd_d0e788434af4b5922020-04-17 · +1dVerified
Massachusetts State AGbd_a2c52e93cb217a0c2020-04-18 · +2dVerified
New Hampshire State AGbd_5845fa1e3cf6c9612020-04-20 · +4dVerified

Name: PrimoHoagies Franchising, Inc.
norm: primohoagies franchising

Name: PrimoHoagies Franchising, Inc.
norm: primohoagies franchising
Industry: Retail & Consumerllm

Discovered: Feb 18, 2020
Breach occurred: Jul 15, 2019 – Feb 18, 2020
Undetected for: 218 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 16, 2020
Affected individuals: 9state-resident count only
Data types: PCIFinancial accountPII
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for Impact
Threat actor: ExternalFinancial

During the incident: Worked with industry-leading cybersecurity firms to assist with an investigation
Contacted payment card brands so steps could be taken prevent fraudulent activity on any affected cards
Notified law enforcement about this criminal activity
Offering complimentary identity protection and credit monitoring services
Changes made: Security for online ordering has been improved to prevent a similar incident from happening in the future
Adjusted the payment platform
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(58 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Montana State AGApr 16 · first · this page

Indiana State AG+1d

Delaware State AG+1d

Massachusetts State AG+2d

New Hampshire State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Breach-NotificationDetails-156.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 16, 2020
Raw hash: 27ee91d8c8d14f284aba00145b4015f0be3bc5fa96d8b1781f300facdca1e035

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityPrimoHoagies Franchising, Inc.

Victim entityPrimoHoagies Franchising, Inc.

Incidentdiscovered Feb 18, 2020

Stated responseWorked with industry-leading cybersecurity firms to assist with an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov