Social EngineeringPhishingData ExfiltratedCustomer Data InvolvedPIICREDENTIALSLowContained
Five Guys
bd_dd813d29e6e97c36 · schema v1 · pii pii-v1
Full breach record for Five Guys →Five Guys Enterprises, LLC reported a phishing incident where an employee's email account was compromised between May 23, 2018, and August 6, 2018. The attacker gained unauthorized access to the inbox, potentially exposing personal information of employees and vendors. The company secured the account, engaged a cybersecurity firm, and offered one year of Experian IdentityWorks. No specific count of affected individuals was disclosed in this sample notification.
California clockDiscovered Aug 6, 2018 → Notified Nov 2, 201888d ✗ CA 60-day late17 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-142256
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Nov 30, 2018
- Raw hash
- eb910e6f8a43cddd6bfbbc749e728f2c2c75e938a0a28abe486062f51aa8db9f
Reporting entity
- Name
- Five Guysnorm: five guys
- Domain
- careers.fiveguys.com
Victim entity
- Name
- Five Guysnorm: five guys
- Domain
- careers.fiveguys.com
Incident
- Discovered
- Aug 6, 2018
- Materiality determined
- —
- Notification sent
- Nov 2, 2018
- Affected individuals
- Not disclosed
- Data types
- PIICREDENTIALS
- Attack vector
- Phishing
- MITRE ATT&CK
- T1566.002 Spearphishing Link
- Threat actor
- External
- Initial access
- phishing_link
Compliance
- Time to disclose
- 17 weeks(116 days from discovery to filing)
- Compliance flags
- CA 60-day late · 88d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Aug 6, 2018→ Notified: Nov 2, 201888d 60 days (analyst band, pre-2026 discoveries) CA 60-day late
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.