MalwareRetail & ConsumerRetailRansomwareData ExfiltratedTargetedPCIFinancial accountIdentity (basic)LowActive

On The Border

bd_dbcf38e32e6abc06 · schema v1 · pii pii-v1

Severity

Low

Discovered

Nov 14, 2019

Filed

Nov 26, 2019

To disclose

12 days

Affected

Not disclosed

Linked

2 filings

Confidence

64%

Full breach record for On The Border →2 incidents on file

On The Border (OTB Acquisition LLC) disclosed a security incident involving malware on a payment processing system affecting certain restaurants in 27 states. The incident impacted payment card information (names, card numbers, expiration dates, verification codes) for transactions between April 10, 2019, and August 10, 2019. The company retained forensic investigators, notified law enforcement and card networks, and is cooperating with investigations. No SSNs or full DOBs were compromised. The investigation was ongoing as of the notice date.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 218 days

discovery → filing · 12 days

Apr 10, 2019

Begins

Nov 14, 2019

Discovered

Nov 26, 2019

Filed

vs. sector median

6 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

South Carolina State AGbd_8aabaabf41f5f3532019-12-02 · +6dVerified

Name: OTB Acquisition LLC
norm: otb acquisition
Domain: ontheborder.com

Name: On The Border
norm: on the border
Domain: ontheborder.com
Industry: Retail & Consumerllm

Discovered: Nov 14, 2019
Breach occurred: Apr 10, 2019 – Aug 10, 2019
Undetected for: 218 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 14, 2019
Affected individuals: Not disclosed
Data types: PCIFinancial accountIdentity (basic)
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1059 Command and Scripting Interpreter
Threat actor: ExternalFinancial
Regulator citations: Notified payment card networksCooperating with law enforcement investigation

During the incident: Retained a leading forensics firm
Cooperating with law enforcement
Notified payment card networks
Taken steps to contain and remediate the incident
Working to identify and remove the malware
Changes made: Working with leading partners in cybersecurity to strengthen and enhance the security of our systems
Regularly update and strengthen systems and processes
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 days(12 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Montana State AGNov 26 · first · this page

South Carolina State AG+6d

Pattern: first filing Nov 26 (MT), last Dec 2 (SC) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/CON-On-the-Border.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 26, 2019
Raw hash: 81cf5ebedaf29dc666d0e2a7867adba8dd30482f8636d26abbbb85e883377474

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityOTB Acquisition LLC

Victim entityOn The Border

Incidentdiscovered Nov 14, 2019

Stated responseRetained a leading forensics firm

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov