MalwareRetail & ConsumerRetailRansomwareData ExfiltratedData EncryptedCustomer Data InvolvedFinancial accountPIILowActive

Chili's Grill & Bar

bd_c76920223dc09d6e · schema v1 · pii pii-v1

Severity

Low

Discovered

May 11, 2018

Filed

May 21, 2018

To disclose

10 days

Affected

Not disclosed

Linked

3 filings

Confidence

65%

Full breach record for Chili's Grill & Bar →

Brinker International (Chili's) disclosed a malware incident compromising payment card data (card numbers, names, potentially CVV/expiry) at certain restaurants between March-April 2018. Discovered May 11, 2018. Affected count unknown. Offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 71 days

discovery → filing · 10 days

Mar 1, 2018

Begins

May 11, 2018

Discovered

May 21, 2018

Filed

vs. sector median

7 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Oregon State AGbd_1b65ad699ea7a1032018-05-23 · +2dVerified
Delaware State AGbd_42ce812ef97bb7462018-05-18 · +3dCandidate

Name: Brinker International, Inc.
norm: brinker international
Domain: brinker.com

Name: Chili's Grill & Bar
norm: chili s grill bar
Industry: Retail & Consumerllm

Discovered: May 11, 2018
Breach occurred: Mar 1, 2018 – Apr 30, 2018
Undetected for: 71 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 12, 2018
Affected individuals: Not disclosed
Data types: Financial accountPII
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Law enforcement has been notified of this incident

During the incident: Immediately activated our response plan
Working with third-party forensic experts to conduct an investigation
Law enforcement has been notified of this incident
Working with ID Experts to provide Guests who may have been impacted with MyIDCare, a free fraud resolution and credit monitoring service
Changes made: Offering 12 months of credit monitoring
$1,000,000 Insurance reimbursement policy
Fully managed identity theft recovery services
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 days(10 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Delaware State AGMay 18 · first

South Carolina State AG+3d · this page

Oregon State AG+5d

Pattern: first filing May 18 (DE), last May 23 (OR) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2018/BrinkerInternational.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 21, 2018
Raw hash: f3986f141238212223c5ff102d43a8e19603e126486aee20219662a3c742dead

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityBrinker International, Inc.

Victim entityChili's Grill & Bar

Incidentdiscovered May 11, 2018

Stated responseImmediately activated our response plan

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceconsumer.sc.gov