HackingRetail & ConsumerRetailData EncryptedTargetedIdentity (basic)Government IDFinancial accountHighContained

CP Franchising, LLC

bd_e92e9b735c93d50e · schema v1 · pii pii-v1

Severity

High

Discovered

Feb 2, 2015

Filed

Mar 4, 2015

To disclose

4 weeks

Affected

3,314state residents only

Linked

3 filings

Confidence

65%

Full breach record for CP Franchising, LLC →

CP Franchising, LLC d/b/a Cruise Planners notified individuals of a cybersecurity incident where an unauthorized person accessed servers around January 30, 2015. The attacker may have obtained PII including SSNs, credit card info, and bank account numbers. The incident was discovered on February 2, 2015. Affected individuals were offered one year of credit monitoring via Experian.

J jump to incidentP pin to compareR raw source

South Carolina clock✓ SC CRA notice due4 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 3 days

discovery → filing · 4 weeks / 30 days

Jan 30, 2015

Begins

Feb 2, 2015

Discovered

Mar 4, 2015

Filed

vs. sector median

3 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

California State AGbd_55182f145b4ac83d2015-02-25 · +7dCandidate
New Hampshire State AGbd_90ed122f89099b872015-02-25 · +7dVerified

Name: CP Franchising, LLC
norm: cp franchising

Name: CP Franchising, LLC
norm: cp franchising
Industry: Retail & Consumerllm

Discovered: Feb 2, 2015
Breach occurred: Jan 30, 2015
Undetected for: 3 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 20, 2015
Affected individuals: 3,314state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Regulator citations: Communicated with the FBINotifying state attorneys general and other regulators
Initial access: exploit_public_facing

During the incident: Engaged Experian to offer complimentary Fraud Resolution and identity protection for one year
Communicated with the FBI and local law enforcement
Notifying state attorneys general and other regulators
Removed the malicious code
Terminated the hacker's access
Working with IT security professionals to evaluate systems and security
Changes made: Providing complimentary Fraud Resolution and identity protection for one year
Working with IT security professionals to evaluate systems and security and provide ongoing monitoring and auditing
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(30 days from discovery to filing)
Compliance flags: SC CRA notice due
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

California State AGFeb 25 · first

New Hampshire State AGFeb 25 · first

South Carolina State AG+7d · this page

Pattern: first filing Feb 25 (CA), last Mar 4 (SC) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2015/CPFranchising%2CLLC.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 4, 2015
Raw hash: fcab47d81296a8049a3c0de0c71d09236d6cf20f6487ef7ea278e9ebdd933152

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityCP Franchising, LLC

Victim entityCP Franchising, LLC

Incidentdiscovered Feb 2, 2015

Stated responseEngaged Experian to offer complimentary Fraud Resolution and identity protection for one year

ComplianceSC CRA notice due

Extraction provenanceno artifact recorded

Source provenanceconsumer.sc.gov