HackingRetail & ConsumerRetailStolen CredentialsCustomer Data InvolvedSupply Chain (3P Vendor)PCIFinancial accountIdentity (basic)LowContained

Jimmy John's

bd_dd63edfcd13e91ec · schema v1 · pii pii-v1

Severity

Low

Discovered

Jul 30, 2014

Filed

Sep 24, 2014

To disclose

8 weeks

Affected

Not disclosed

Linked

2 filings

Confidence

62%

Full breach record for Jimmy John's →

Jimmy John's Franchises LLC notified customers of a security incident involving credit and debit card data at approximately 216 corporate and franchised locations. An intruder stole login credentials from Jimmy John's point-of-sale vendor and used them to remotely access point-of-sale systems between June 16, 2014, and September 5, 2014. The company learned of the incident on July 30, 2014. Affected data may include card numbers, cardholder names, verification codes, and expiration dates. The incident has been contained, and the company is offering identity protection services.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jul 30, 2014 → Notified Sep 24, 201456d ✓ CA 60-day OK8 weeks discovery → filing

Incident timeline

undetected · 44 days

discovery → filing · 8 weeks / 56 days

Jun 16, 2014

Begins

Jul 30, 2014

Discovered

Sep 24, 2014

Filed

vs. sector median

on median

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

New Hampshire State AGbd_ae57e2cb0e66e48d2014-09-24Candidate

Name: Jimmy John's
norm: jimmy john s
Domain: jimmyjohns.com

Name: Jimmy John's
norm: jimmy john s
Domain: jimmyjohns.com
Industry: Retail & Consumerllm

Discovered: Jul 30, 2014
Breach occurred: Jun 16, 2014 – Sep 5, 2014
Undetected for: 44 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 24, 2014
Affected individuals: Not disclosed
Data types: PCIFinancial accountIdentity (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Third party: via point-of-sale vendor
Initial access: trusted_relationship

During the incident: Hired third party forensic experts to assist with its investigation
Contained the security compromise
Offering identity protection services to impacted customers
Changes made: Installing encrypted swipe machines
Implementing system enhancements
Reviewing its policies and procedures for its third party vendors
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(56 days from discovery to filing)
Compliance flags: CA 60-day OK · 56d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jul 30, 2014
→ Notified: Sep 24, 2014
56d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jul 30, 2014 → Notified: Sep 24, 2014	56d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

New Hampshire State AGSep 24 · first

California State AGSep 24 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-46686
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 24, 2014
Raw hash: 3de8e4dc93e7e3d0427655ac0ace248c2c465c91bfc025e588ea53eb11503ef2

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityJimmy John's

Victim entityJimmy John's

Incidentdiscovered Jul 30, 2014

Stated responseHired third party forensic experts to assist with its investigation

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov