PhysicalRetail & ConsumerRetailSkimmerCustomer Data InvolvedFinancial accountFinancial credentialsIdentity (basic)LowContained

STATER BROS. MARKETS

bd_b6bba517127442ca · schema v1 · pii pii-v1

Severity

Low

Discovered

Apr 8, 2015

Filed

Apr 24, 2015

To disclose

16 days

Affected

Not disclosed

Confidence

66%

Full breach record for STATER BROS. MARKETS →

Stater Bros. Markets discovered a skimmer device attached to a point-of-sale terminal in the deli department of its West Covina, California store on April 8, 2015. The device was installed on March 5, 2015, and removed on March 29, 2015. The skimmer may have captured cardholder names, account numbers, expiration dates, verification codes, and debit card PINs. The company launched an investigation, contacted law enforcement, and is working with credit card companies to alert affected cardholders. No other stores were affected.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 34 days

discovery → filing · 16 days

Mar 5, 2015

Begins

Apr 8, 2015

Discovered

Apr 24, 2015

Filed

vs. sector median

7 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: STATER BROS. MARKETS
norm: stater bros markets

Name: STATER BROS. MARKETS
norm: stater bros markets
Industry: Retail & Consumerllm

Discovered: Apr 8, 2015
Breach occurred: Mar 5, 2015 – Mar 29, 2015
Undetected for: 34 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Financial accountFinancial credentialsIdentity (basic)
Attack vector: Unknown
MITRE ATT&CK: T1528 Steal Web Session CookieT1056 Input Capture
Threat actor: ExternalFinancial

During the incident: Launched an investigation
Contacted local law enforcement
Working with the credit card companies and processors to provide them with the account numbers for cards used during the period at issue
Changes made: Accelerated pre-existing plans to provide multiple layers of protection for cardholders’ data
Enhanced policies and procedures designed to prevent unauthorized devices from being connected to point-of-sale terminals
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 days(16 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-55627
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 24, 2015
Raw hash: 3d259840ad5ba1b59e01bf66993803ded646205f665fa238553f1471ebe006e9

Reporting entitySTATER BROS. MARKETS

Victim entitySTATER BROS. MARKETS

Incidentdiscovered Apr 8, 2015

Stated responseLaunched an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov