MalwareRetail & ConsumerRetailRansomwareData ExfiltratedData EncryptedPCIFinancial accountHighContained

Deli Management, Inc.

bd_cbf566c95e6d44ca · schema v1 · pii pii-v1

Severity

High

Discovered

Dec 22, 2017

Filed

May 23, 2018

To disclose

22 weeks

Affected

3,400,000

Linked

6 filings

Confidence

61%

Full breach record for Deli Management, Inc. →3 incidents on file

Deli Management, Inc. dba Jason's Deli reported a supplemental data breach involving RAM-scraping malware on POS terminals. The incident occurred from June 8, 2017, to December 29, 2017, affecting approximately 3.4 million unique payment cards. The malware exfiltrated full track data including cardholder names and card numbers. The breach was discovered on December 22, 2017, and the company engaged forensic experts and law enforcement.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 197 days

discovery → filing · 22 weeks / 152 days

Jun 8, 2017

Begins

Dec 22, 2017

Discovered

May 23, 2018

Filed

vs. sector median

+14 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

South Carolina State AGbd_7c535625e66137ba2018-01-16 · +127dVerified
California State AGbd_0ec52a323ee32b9b2018-01-11 · +132dVerified
Washington State AGbd_49b1df9a42b8fc112018-01-11 · +132dCandidate
New Hampshire State AGbd_4d7485eb2704057b2018-01-11 · +132dVerified

Show 1 more filing ↓up to 132d gap

Oregon State AGbd_864fe98185e8613f2018-01-11 · +132dVerified

Name: Deli Management, Inc.
norm: deli management
Domain: jasonsdeli.com

Name: Deli Management, Inc.
norm: deli management
Domain: jasonsdeli.com
Also named: Deli Management, Inc.dba oflegal entity
Jason's Deli, Inc.dba oftrade name
Industry: Retail & Consumerllm

Discovered: Dec 22, 2017
Breach occurred: Jun 8, 2017 – Dec 29, 2017
Undetected for: 197 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 18, 2018
Affected individuals: 3,400,000nationwide
Data types: PCIFinancial account
Attack vector: Unknown
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General

During the incident: Activated our response plan
Engagement of a leading threat response team
Involvement of other forensic experts
Cooperation with law enforcement
Contained the breach and disabled the malware
Investigating the criminals behind this breach
Changes made: Investing in advanced network monitoring capabilities
Improving our payment systems to protect the security of cardholder information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 22 weeks(152 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 5 states

View merged incident ↗

California State AGJan 11 · first

Washington State AGJan 11 · first

New Hampshire State AGJan 11 · first

Oregon State AGJan 11 · first

South Carolina State AG+5d

New Hampshire State AG+132d · this page

Pattern: first filing Jan 11 (CA), last May 23 (NH) — a 132-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/deli-management-20180523.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 23, 2018
Raw hash: 28f96b69abeba26442403c637ab5fc311621823d0028e1e8e3584478c4107e43

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityDeli Management, Inc.

Victim entityDeli Management, Inc.

Incidentdiscovered Dec 22, 2017

Stated responseActivated our response plan

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov