FEDERALItem 8.01 · voluntaryMalwareRetail & ConsumerRetailRansomwareData ExfiltratedData EncryptedLowActive

YUM! Brands, Inc.

bd_930c9d1e16f8cabc · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Jan 19, 2023

To disclose

—

Affected

Not disclosed

Linked

12 filings

Confidence

69%

Full breach record for YUM! Brands, Inc. →

Yum! Brands, Inc. disclosed a ransomware attack on January 18, 2023, impacting IT systems and causing temporary disruption to less than 300 UK restaurants. The company took systems offline, engaged forensic professionals, and notified federal law enforcement. While data was exfiltrated, customer databases were reportedly not stolen.

J jump to incidentP pin to compareR raw source

Incident timeline — partial

? — ?

Breach window unknown

Jan 19, 2023

Filed

—

Corroborated · see linked filings

Compliance clocks stay unassessable until a regulatory filing lands. Dashed segments fill in automatically when corroboration arrives.

This filing is one of 12 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Washington State AGbd_05b2f3b76db7eda62023-04-07 · +78dVerified
Maine State AGbd_670ffb1c99274f7f2023-04-07 · +78dVerified
California State AGbd_17c063610aa17e652023-04-13 · +84dVerified
New Hampshire State AGbd_712a74721c6ee1982023-04-13 · +84dVerified

Show 6 more filings ↓up to 85d gap

South Carolina State AGbd_9ae9f2172a786b372023-04-13 · +84dVerified
Oregon State AGbd_01aaa01480a1e00b2023-04-14 · +85dVerified
Massachusetts State AGbd_0c9b16de08be41bb2023-04-14 · +85dVerified
Montana State AGbd_48c445e8e34473fd2023-04-14 · +85dVerified
Indiana State AGbd_c7e1cad9d4df49212023-04-14 · +85dVerified
Delaware State AGbd_edd346b972acb4e02023-04-14 · +85dVerified

Showing first 10 of 11 linked disclosures.

Name: YUM! Brands, Inc.
norm: yum brands
SEC CIK: 0001041061
Industry: Restaurants

Name: YUM! Brands, Inc.
norm: yum brands
SEC CIK: 0001041061
Industry: Restaurants
Industry: Retail & Consumerllm

Discovered: —
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: —
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for Impact
Threat actor: ExternalFinancial
Regulator citations: notified Federal law enforcement

During the incident: Deploying containment measures such as taking certain systems offline
Implementing enhanced monitoring technology
Initiated an investigation
Engaged the services of industry-leading cybersecurity and forensics professionals
Notified Federal law enforcement
Changes made: Fully restoring affected systems
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 10 states

View merged incident ↗

SEC 8-KJan 19 · first · this page

Washington State AG+78d

Maine State AG+78d

California State AG+84d

New Hampshire State AG+84d

South Carolina State AG+84d

Oregon State AG+85d

Massachusetts State AG+85d

Montana State AG+85d

Indiana State AG+85d

Delaware State AG+85d

Pattern: first filing Jan 19, last Apr 14 (DE) — a 85-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 11 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filing

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statementThis record

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.sec.gov/Archives/edgar/data/1041061/000110465923004769/
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Jan 19, 2023
Raw hash: c86dde1e69315efe5406c86b40b03552332b6474ab07e1f29785dd89ac0cf765

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html25.7 KB

Download View at source

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityYUM! Brands, Inc.

Victim entityYUM! Brands, Inc.

IncidentRansomware

Stated responseDeploying containment measures such as taking certain systems offline

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancewww.sec.gov

Source filing