Social EngineeringRetail & ConsumerRetailPhishingEmployee Data InvolvedPIIIdentity (basic)LowResolved

Five Guys Holdings, Inc.

bd_dd813d29e6e97c36 · schema v1 · pii pii-v1

Severity

Low

Discovered

Aug 6, 2018

Filed

Nov 30, 2018

To disclose

17 weeks

Affected

Not disclosed

Linked

5 filings

Confidence

64%

Full breach record for Five Guys Holdings, Inc. →5 incidents on file

Five Guys Enterprises, LLC reported that an employee fell victim to a phishing email, resulting in unauthorized access to their email account between May 23, 2018, and August 6, 2018. The company discovered the incident on August 6, 2018. The breach potentially exposed personal information of employees and vendors. Five Guys secured the account, engaged a cybersecurity firm, and offered one year of identity monitoring services.

J jump to incidentP pin to compareR raw source

California clockDiscovered Aug 6, 2018 → Notified Nov 29, 2018115d ✗ CA 60-day late17 weeks discovery → filing

Incident timeline

undetected · 75 days

discovery → filing · 17 weeks / 116 days

May 23, 2018

Begins

Aug 6, 2018

Discovered

Nov 30, 2018

Filed

vs. sector median

+9 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

New Hampshire State AGbd_737fd489118d8ac92018-12-03 · +3dVerified
New Hampshire State AGbd_912b3a1d2a2cf3812018-11-06 · +24dVerified
California State AGbd_07f36ad709cc046f2018-11-02 · +28dCandidate
Montana State AGbd_956df4f5240be8cc2018-11-02 · +28dVerified

Name: Five Guys Holdings, Inc.
norm: five guys
Domain: fiveguys.com

Name: Five Guys Holdings, Inc.
norm: five guys
Domain: fiveguys.com
Industry: Retail & Consumerllm

Discovered: Aug 6, 2018
Breach occurred: May 23, 2018 – Aug 6, 2018
Undetected for: 75 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 29, 2018
Affected individuals: Not disclosed
Data types: PIIIdentity (basic)
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1114 Email Collection
Threat actor: External
Initial access: phishing_link

During the incident: Immediately secured the e-mail account
Conducted an internal investigation
Engaged a leading cyber security firm to assist in the investigation
Began the extensive process of searching the employee’s inbox to identify the contents
Offering a complimentary one-year membership in Experian’s IdentityWorks
Changes made: Implementing additional procedures, education and training to further enhance and strengthen our security processes
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 17 weeks(116 days from discovery to filing)
Compliance flags: CA 60-day late · 115d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Aug 6, 2018
→ Notified: Nov 29, 2018
115d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Aug 6, 2018 → Notified: Nov 29, 2018	115d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 3 states

View merged incident ↗

California State AGNov 2 · first

Montana State AGNov 2 · first

New Hampshire State AG+4d

California State AG+28d · this page

New Hampshire State AG+31d

Pattern: first filing Nov 2 (CA), last Dec 3 (NH) — a 31-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-142256
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 30, 2018
Raw hash: eb910e6f8a43cddd6bfbbc749e728f2c2c75e938a0a28abe486062f51aa8db9f

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityFive Guys Holdings, Inc.

Victim entityFive Guys Holdings, Inc.

Incidentdiscovered Aug 6, 2018

Stated responseImmediately secured the e-mail account

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov