MalwareRetailData ExfiltratedCustomer Data InvolvedPCIFinancial accountFinancial credentialsIdentity (basic)LowContained

PrimoHoagies Franchising, Inc.

bd_d0e788434af4b592 · schema v1 · pii pii-v1

Severity

Low

Discovered

Feb 18, 2020

Filed

Apr 17, 2020

To disclose

8 weeks

Affected

Not disclosed

Linked

5 filings

Confidence

64%

Full breach record for PrimoHoagies Franchising, Inc. →

PrimoHoagies Franchising, Inc. disclosed a malware incident affecting its online payment platform. Unauthorized parties accessed payment card information (names, addresses, card numbers, expiration dates, security codes) for online orders placed between July 15, 2019, and February 18, 2020. The company engaged cybersecurity firms, contacted payment card brands, and notified law enforcement. The issue was resolved, and security was improved. No specific count of affected individuals was disclosed.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 218 days

discovery → filing · 8 weeks / 59 days

Jul 15, 2019

Begins

Feb 18, 2020

Discovered

Apr 17, 2020

Filed

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Indiana State AGbd_af7a1c1f2f3480122020-04-17Verified
Massachusetts State AGbd_a2c52e93cb217a0c2020-04-18 · +1dVerified
Montana State AGbd_7a9e245e5d4f2b6e2020-04-16 · +1dCandidate
New Hampshire State AGbd_5845fa1e3cf6c9612020-04-20 · +3dVerified

Name: PrimoHoagies Franchising, Inc.
norm: primohoagies franchising

Name: PrimoHoagies Franchising, Inc.
norm: primohoagies franchising

Discovered: Feb 18, 2020
Breach occurred: Jul 15, 2019 – Feb 18, 2020
Undetected for: 218 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 1, 2020
Affected individuals: Not disclosed
Data types: PCIFinancial account
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for Impact
Threat actor: ExternalFinancial

During the incident: Worked with industry-leading cybersecurity firms to assist with an investigation
Contacted payment card brands so steps could be taken prevent fraudulent activity on any affected cards
Notified law enforcement about this criminal activity
Changes made: Problem with the online payment system has been resolved
Security for online ordering has been improved
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(59 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Montana State AGApr 16 · first

Indiana State AG+1d

Delaware State AG+1d · this page

Massachusetts State AG+2d

New Hampshire State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://attorneygeneral.delaware.gov/wp-content/uploads/sites/50/2020/06/PrimoHoagies-Substitute-Notice.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 17, 2020
Raw hash: ebbca88c9b5950fbc791d48af4ba981a898a6ed290678911e01ff1224fe37f18

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityPrimoHoagies Franchising, Inc.

Victim entityPrimoHoagies Franchising, Inc.

Incidentdiscovered Feb 18, 2020

Stated responseWorked with industry-leading cybersecurity firms to assist with an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceattorneygeneral.delaware.gov