MalwareHospitalityHospitalityRansomwareData EncryptedCustomer Data InvolvedIdentity (basic)Government IDMediumContained

U.S. Restaurants, Inc.

bd_b21078295a6ef652 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 7, 2020

Filed

Jul 21, 2020

To disclose

24 weeks

Affected

12state residents only

Linked

4 filings

Confidence

66%

Full breach record for U.S. Restaurants, Inc. →

U.S. Restaurants, Inc. reported that on February 7, 2020, an unauthorized third party accessed its computer systems and infected them with ransomware. The incident potentially impacted the personal information of 12 New Hampshire residents, including names and Social Security numbers. The company contained the incident, engaged forensic investigators, and is offering credit monitoring services.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 24 weeks / 165 days

Feb 7, 2020

Begins

Feb 7, 2020

Discovered

Jul 21, 2020

Filed

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Montana State AGbd_12e4fc2557a4bd7b2020-07-21Candidate
Massachusetts State AGbd_65f20711dafeedd22020-07-21Verified
Indiana State AGbd_70e58d495941d2b82020-07-21Verified

Name: U.S. Restaurants, Inc.
norm: us restaurants

Name: U.S. Restaurants, Inc.
norm: us restaurants
Industry: Hospitalityllm

Discovered: Feb 7, 2020
Breach occurred: Feb 7, 2020
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 21, 2020
Affected individuals: 12state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for Impact
Threat actor: External
Regulator citations: Notified the Attorney General of the State of New Hampshire

During the incident: Launched an internal investigation
Secured its computer systems to prevent potential further access
Retained a leading forensic security firm to investigate the incident and confirm the security of its computer systems
Worked with a document review vendor to conduct a programmatic review of the contents of the impacted accounts
Manually reviewed the items identified as potentially at risk by that programmatic review
Notified impacted individuals
Provided them with information on how they can protect themselves against fraudulent activity and identity theft
Changes made: Updating its administrative, physical, and technical security measures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 24 weeks(165 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Montana State AGJul 21 · first

Massachusetts State AGJul 21 · first

Indiana State AGJul 21 · first

New Hampshire State AGJul 21 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/us-restaurants-20200721.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 21, 2020
Raw hash: 4e49699f8b4c8e5df4080f0357ba5189b4423aed2090d2b26885e68dc6b93703

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityU.S. Restaurants, Inc.

Victim entityU.S. Restaurants, Inc.

Incidentdiscovered Feb 7, 2020

Stated responseLaunched an internal investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov