MalwareProfessional ServicesHospitalityProfessional ServicesSkimmerCustomer Data InvolvedSupply Chain (3P Vendor)Financial accountFinancial credentialsIdentity (basic)LowContained

COMPASS GROUP USA, INC.

bd_7df45cd8c4031749 · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Apr 27, 2015

To disclose

—

Affected

Not disclosed

Confidence

66%

Full breach record for COMPASS GROUP USA, INC. →

Compass Group USA, Inc. disclosed a security incident involving NEXTEP self-serve kiosks at three California locations. Unauthorized individuals installed malicious software to capture payment card data (account numbers, expiration dates, CVVs) between February 2 and March 9, 2015. The incident was contained, and affected users were offered one year of identity protection services.

J jump to incidentP pin to compareR raw source

Incident timeline

Feb 2, 2015

Begins

Apr 27, 2015

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: COMPASS GROUP USA, INC.
norm: compass group usa
Domain: compass-usa.com

Name: COMPASS GROUP USA, INC.
norm: compass group usa
Domain: compass-usa.com
Industry: Professional ServicesllmHospitalityllm

Discovered: —
Breach occurred: Feb 2, 2015 – Mar 9, 2015
Materiality determined: —
Notification sent: Apr 16, 2015
Affected individuals: Not disclosed
Data types: Financial accountFinancial credentialsIdentity (basic)
Attack vector: Unknown
MITRE ATT&CK: T1528 Steal Application Access TokenT1056 Input Capture
Threat actor: ExternalFinancial
Third party: via NEXTEP

During the incident: Disabled payment card acceptance on the affected kiosks
Removed the malicious software from the kiosks
Offering one year of free identity protection services, including credit monitoring
Changes made: Removed the malicious software from the kiosks
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-55656
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 27, 2015
Raw hash: d2e251f1c0ee3a683a24f91a89f7ba33049c4e6cad7f4c03e3cf0f762168b93d

Reporting entityCOMPASS GROUP USA, INC.

Victim entityCOMPASS GROUP USA, INC.

IncidentUnknown

Stated responseDisabled payment card acceptance on the affected kiosks

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov