MalwareRetail & ConsumerRetailSkimmerData ExfiltratedCustomer Data InvolvedPCIFinancial accountFinancial credentialsIdentity (basic)LowContained

Evergreen Alliance Golf Limited L.P.

bd_d06a8cacda0be11d · schema v1 · pii pii-v1

Severity

Low

Discovered

Jan 16, 2019

Filed

Feb 25, 2019

To disclose

6 weeks

Affected

Not disclosed

Linked

3 filings

Confidence

65%

Full breach record for Evergreen Alliance Golf Limited L.P. →

Evergreen Alliance Golf Limited, L.P. (operating as Arcis Golf) disclosed a data breach involving malware on point-of-sale devices at certain locations. The malware was designed to access payment card track data from August 15, 2018, to February 4, 2019. The incident was identified on January 16, 2019. Affected data includes card numbers, expiration dates, internal verification codes, and sometimes cardholder names. The company engaged a security firm, removed the malware, and deployed endpoint security tools.

J jump to incidentP pin to compareR raw source

Date basis clock✓ Clock withheld · confirmation date6 weeks discovery → filing

Incident timeline

undetected · 154 days

discovery → filing · 6 weeks / 40 days

Aug 15, 2018

Begins

Jan 16, 2019

Discovered

Feb 25, 2019

Filed

vs. sector median

2 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

New Hampshire State AGbd_2f47721ef0e84d8b2019-02-26 · +1dVerified
Montana State AGbd_585d3b6b52d2be372019-03-01 · +4dVerified

Name: Evergreen Alliance Golf Limited L.P.
norm: evergreen alliance golf

Name: Evergreen Alliance Golf Limited L.P.
norm: evergreen alliance golf
Industry: Retail & Consumerllm

Discovered: Jan 16, 2019
Breach occurred: Aug 15, 2018 – Feb 4, 2019
Undetected for: 154 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 16, 2019
Affected individuals: Not disclosed
Data types: PCIFinancial accountFinancial credentialsIdentity (basic)
Attack vector: Unknown
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial

During the incident: Launched an investigation
Engaged a leading computer security firm to assist
Removed the malware
Deployed an endpoint security tool to devices across our network
Partner with the cyber security firm to evaluate ways to enhance our security measures
Working with the payment card networks so that the banks that issue payment cards can be made aware of the incident and initiate heightened monitoring
Changes made: Deployed an endpoint security tool to devices across our network
Evaluate ways to enhance our security measures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(40 days from discovery to filing)
Compliance flags: Clock withheld · confirmation date

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

California State AGFeb 25 · first · this page

New Hampshire State AG+1d

Montana State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-145001
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 25, 2019
Raw hash: d3fdc9d68e9d88164f8644d913cf8dec332eea59fc6b9320349d4225b66ccafd

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityEvergreen Alliance Golf Limited L.P.

Victim entityEvergreen Alliance Golf Limited L.P.

Incidentdiscovered Jan 16, 2019

Stated responseLaunched an investigation

ComplianceClock withheld · confirmation date

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov