MalwareRetail & ConsumerRetailRansomwareSupply Chain (3P Vendor)Data EncryptedFinancial accountPIIMediumContained

Quaker Steak & Lube

bd_e7b6ec691dc3d16a · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Jan 13, 2020

To disclose

—

Affected

1,000state residents only

Confidence

66%

Full breach record for Quaker Steak & Lube →

Quaker Steak & Lube of South Carolina, LLC reported a payment card security event at its Greenville, SC restaurant. Malicious software was deployed on the POS system via a third-party vendor, Midwest POS Solutions, Inc., using stolen credentials. Data accessed included cardholder names, numbers, expiration dates, and CVVs from Feb 14 to Sep 3, 2019. No SSNs or PINs were involved. Forensic investigators were engaged, and card brands were notified.

J jump to incidentP pin to compareR raw source

Incident timeline

Feb 14, 2019

Begins

Jan 13, 2020

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1,000 affectedView incident

Name: Quaker Steak & Lube
norm: quaker steak lube
Domain: thelube.com

Name: Quaker Steak & Lube
norm: quaker steak lube
Domain: thelube.com
Industry: Retail & Consumerllm

Discovered: —
Breach occurred: Feb 14, 2019 – Sep 3, 2019
Materiality determined: —
Notification sent: —
Affected individuals: 1,000state-resident count only
Data types: Financial accountPII
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1486 Data Encrypted for Impact
Threat actor: ExternalFinancial
Third party: via Midwest POS Solutions, Inc.
Initial access: supply_chain

During the incident: Worked with third-party forensic investigators
Deployment of security tools to contain, disable, and destroy any malicious software
Enhancing existing security measures
Reported to card brands Visa, MasterCard, Discover and American Express
Changes made: Deployment of security tools to contain, disable, and destroy any malicious software
Enhancing existing security measures to reduce the likelihood of future incidents
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/QuakerSteak.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 13, 2020
Raw hash: 2f2839ef2b3198a0fd46e78d52e0175773dd0a4d93212c675b15219504078e9c

Reporting entityQuaker Steak & Lube

Victim entityQuaker Steak & Lube

IncidentThird-Party / Supply Chain

Stated responseWorked with third-party forensic investigators

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceconsumer.sc.gov