MalwareRansomwareData EncryptedFINANCIAL_ACCOUNTIDENTITY_BASICLowContained
NOODLES & COMPANY
bd_f067485ce8b16b95 · schema v1 · pii pii-v1
Full breach record for NOODLES & COMPANY →Noodles & Company disclosed a data security incident affecting guests who used debit or credit cards at certain locations between Jan 31 and Jun 2, 2016. Malware compromised cardholder name, number, expiration, and CVV. The company engaged forensic investigators and the US Secret Service, removed the malware, and confirmed cards are no longer at risk. No SSNs were involved.
California clockDiscovered Jun 2, 2016 → Notified Jun 28, 201626d ✓ CA 60-day OK26 days discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 3 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (2) · sorted by filing gap
- bd_1ea381574cf8a21dWashington State AGfiled 2016-06-28Candidate
- bd_592da2110490c72bOregon State AGfiled 2016-06-29(1d gap)Verified
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-62596
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jun 28, 2016
- Raw hash
- 0c349c5779d69c6104d8fcd8b5a1439a5ee4a3d781186fdf7a23f825fafa46a5
Reporting entity
- Name
- NOODLES & COMPANYnorm: noodles
Victim entity
- Name
- NOODLES & COMPANYnorm: noodles
Incident
- Discovered
- Jun 2, 2016
- Materiality determined
- —
- Notification sent
- Jun 28, 2016
- Affected individuals
- Not disclosed
- Data types
- FINANCIAL_ACCOUNTIDENTITY_BASIC
- Attack vector
- Unknown
- MITRE ATT&CK
- T1074 Data Staged
- Threat actor
- ExternalFinancial
- Regulator citations
- working with the United States Secret Service to investigate this incident
Compliance
- Time to disclose
- 26 days(26 days from discovery to filing)
- Compliance flags
- CA 60-day OK · 26d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Jun 2, 2016→ Notified: Jun 28, 201626d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.