HackingRetail & ConsumerRetailStolen CredentialsTargetedCustomer Data InvolvedIdentity (basic)Financial accountCredentialsLowContained

EatStreet

bd_a08f50a84a462954 · schema v1 · pii pii-v1

Severity

Low

Discovered

May 17, 2019

Filed

Aug 6, 2019

To disclose

12 weeks

Affected

23state residents only

Linked

4 filings

Confidence

65%

Full breach record for EatStreet →

EatStreet, Inc. reported that an unauthorized third party gained access to its database on May 3, 2019, discovered on May 17, 2019. The incident involved access to diner customer payment card information, including names, card numbers, CVV, billing addresses, emails, and phone numbers. EatStreet engaged forensic investigators, audited systems, and enhanced security controls including MFA.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 14 days

discovery → filing · 12 weeks / 81 days

May 3, 2019

Begins

May 17, 2019

Discovered

Aug 6, 2019

Filed

vs. sector median

+4 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Montana State AGbd_479241cd8f1e9b6e2019-07-14 · +23dVerified
Massachusetts State AGbd_1cc588007e9343b02019-06-14 · +53dVerified
California State AGbd_6c8bdb60faeed3362019-06-14 · +53dCandidate

Name: EatStreet
norm: eatstreet
Domain: go.geteatstreet.com

Name: EatStreet
norm: eatstreet
Domain: go.geteatstreet.com
Industry: Retail & Consumerllm

Discovered: May 17, 2019
Breach occurred: May 3, 2019
Undetected for: 14 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 23state-resident count only
Data types: Identity (basic)Financial accountCredentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: ExternalFinancial
Initial access: valid_credentials

During the incident: Hired a leading external IT forensics firm to respond to and investigate the incident
Audited our systems to validate that there was no other unauthorized access
Enhanced the security of our systems, including reinforcing multi-factor authentication, rotating credential keys and reviewing and updating coding practices
Notified our credit card payment processor of the incident
Changes made: Reinforcing multi-factor authentication
Rotating credential keys
Reviewing and updating coding practices
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 weeks(81 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Massachusetts State AGJun 14 · first

California State AGJun 14 · first

Montana State AG+30d

South Carolina State AG+53d · this page

Pattern: first filing Jun 14 (MA), last Aug 6 (SC) — a 53-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2019/EatStreet.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 6, 2019
Raw hash: 253736975807167cd97bc1a7258be6adf704a99d79513beba3dad0de47b70b94

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityEatStreet

Victim entityEatStreet

Incidentdiscovered May 17, 2019

Stated responseHired a leading external IT forensics firm to respond to and investigate the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceconsumer.sc.gov