Dependable Foods
bd_dbe1cac7b05f025f · schema v1 · pii pii-v1
Full breach record for Dependable Foods →The Wendy’s Company reported a data breach affecting payment card information at some franchisee-operated restaurants in the U.S. The incident occurred between December 2, 2015, and June 8, 2016. The company first reported unusual activity in February 2016. The breach resulted from compromised remote access credentials of a service provider, which allowed attackers to deploy malware on point-of-sale systems. Affected data included cardholder name, credit/debit card number, expiration date, cardholder verification value, and service code. Wendy’s disabled the malware and offered one year of complimentary fraud consultation and identity restoration services to affected customers.
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-62714
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jul 7, 2016
- Raw hash
- 9fa3f934c6939b177997eb1d8713cde2175e6fc68a1d22cf5f8735ba036694ec
Reporting entity
- Name
- Dependable Foodsnorm: dependable foods
Victim entity
- Name
- Dependable Foodsnorm: dependable foods
Incident
- Discovered
- Feb 1, 2016
- Materiality determined
- —
- Notification sent
- Jul 7, 2016
- Affected individuals
- Not disclosed
- Data types
- PCIFINANCIAL_ACCOUNTFINANCIAL_CREDENTIALSIDENTITY_BASIC
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1078 Valid AccountsT1053.005 Scheduled Task/JobT1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
- Threat actor
- ExternalFinancial
- Regulator citations
- Notified California Attorney General
- Third party
- via Service Provider
- Initial access
- trusted_relationship
Compliance
- Time to disclose
- 22 weeks(157 days from discovery to filing)
- Compliance flags
- CA 60-day late · 157d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Feb 1, 2016→ Notified: Jul 7, 2016157d 60 days (analyst band, pre-2026 discoveries) CA 60-day late
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.