HackingRetail & ConsumerRetailStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedFinancial accountIdentity (basic)LowContained

Jimmy John's

bd_ae57e2cb0e66e48d · schema v1 · pii pii-v1

Severity

Low

Discovered

Jul 30, 2014

Filed

Sep 24, 2014

To disclose

8 weeks

Affected

Not disclosed

Linked

2 filings

Confidence

64%

Full breach record for Jimmy John's →

Jimmy John's Franchises LLC notified the NH AG of a security incident where an intruder stole credentials from POS vendor Signature Systems, Inc. to access POS systems between June 16 and Sept 5, 2014. Incident discovered July 30, 2014. ~216 stores affected; card data (number, name, exp date) compromised. No NH locations affected. Contained; forensic experts hired; credit monitoring offered.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 44 days

discovery → filing · 8 weeks / 56 days

Jun 16, 2014

Begins

Jul 30, 2014

Discovered

Sep 24, 2014

Filed

vs. sector median

on median

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

California State AGbd_dd63edfcd13e91ec2014-09-24Verified

Name: Jimmy John's
norm: jimmy john s
Domain: jimmyjohns.com

Name: Jimmy John's
norm: jimmy john s
Domain: jimmyjohns.com
Industry: Retail & Consumerllm

Discovered: Jul 30, 2014
Breach occurred: Jun 16, 2014 – Sep 5, 2014
Undetected for: 44 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 24, 2014
Affected individuals: Not disclosed
Data types: Financial accountIdentity (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: telephonic notification of September 02, 2014update to prior telephonic notification
Initial access: valid_credentials

During the incident: Hired third party forensic experts to assist with its investigation
Security compromise has been contained
Contracted with identity theft protection experts AllClear ID to provide identity theft restoration to impacted individuals at no cost to individuals for one year
Notice is also being provided to the credit reporting agencies
Changes made: Installing encrypted swipe machines
Implementing system enhancements
Reviewing its policies and procedures for third party vendors
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(56 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

California State AGSep 24 · first

New Hampshire State AGSep 24 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/jimmy-johns-20140924.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 24, 2014
Raw hash: 5bf0ed9947781aae2ecfa18a63d4e5286ba123a243120c62ab0835cc6a1a4bee

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityJimmy John's

Victim entityJimmy John's

Incidentdiscovered Jul 30, 2014

Stated responseHired third party forensic experts to assist with its investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov