HackingRetail & ConsumerRetailTargetedIdentity (basic)Government IDMediumContained

Taco John's International, Inc.

bd_d2ad43e1738dd86d · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 24, 2021

Filed

Oct 19, 2021

To disclose

17 weeks

Affected

8state residents only

Linked

3 filings

Confidence

67%

Full breach record for Taco John's International, Inc. →

Taco John's International, Inc. notified Montana residents of unauthorized access to systems containing names and Social Security numbers. Suspicious activity was detected on June 24, 2021. The company engaged forensic specialists, conducted a comprehensive review, and is offering credit monitoring services.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 17 weeks / 117 days

Jun 24, 2021

Discovered

Oct 19, 2021

Filed

vs. sector median

+7 wks slower

This filing is one of 3 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_382e88dce90db8862021-10-19Verified
Indiana State AGbd_fdbe799da24d27962021-10-19Verified

Name: Taco John's International, Inc.
norm: taco john s

Name: Taco John's International, Inc.
norm: taco john s
Industry: Retail & Consumerllm

Discovered: Jun 24, 2021
Materiality determined: —
Notification sent: —
Affected individuals: 8state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: notifying pertinent state and/or federal regulators

During the incident: Promptly launched an investigation with the assistance of third-party forensic specialists
Embarked on a comprehensive review of all impacted systems
Providing notice of this incident to potentially impacted individuals and pertinent state and/or federal regulators
Offering you complimentary access to credit monitoring and identity theft restoration services, through TransUnion
Changes made: All policies and procedures are being reviewed and enhanced where possible
Additional safeguards are being implemented
Workforce training is being conducted to reduce the likelihood of a similar event in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 17 weeks(117 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGOct 19 · first

Indiana State AGOct 19 · first

Montana State AGOct 19 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-Notification-Letter-20.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 19, 2021
Raw hash: b0aea531769da779ccf9c7684cae0928f4c38f15da484766f016adff5d545de5

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityTaco John's International, Inc.

Victim entityTaco John's International, Inc.

Incidentdiscovered Jun 24, 2021

Stated responsePromptly launched an investigation with the assistance of third-party forensic specialists

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov