MalwareRetail & ConsumerRetailInfostealerData ExfiltratedCustomer Data InvolvedFinancial accountFinancial credentialsIdentity (basic)LowContained

NOODLES & COMPANY

bd_f067485ce8b16b95 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jun 2, 2016

Filed

Jun 28, 2016

To disclose

26 days

Affected

Not disclosed

Linked

4 filings

Confidence

64%

Full breach record for NOODLES & COMPANY →

Noodles & Company disclosed a data security incident involving malware that compromised payment card data (cardholder name, card number, expiration date, CVV) at certain locations between January 31, 2016, and June 2, 2016. The company discovered suspicious activity on June 2, 2016, after its credit card processor reported unusual activity. The malware was removed to contain the incident. The company is working with third-party forensic investigators and the US Secret Service. No specific count of affected individuals was disclosed in the notice.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jun 2, 2016 → Notified Jun 28, 201626d ✓ CA 60-day OK26 days discovery → filing

Incident timeline

undetected · 123 days

discovery → filing · 26 days

Jan 31, 2016

Begins

Jun 2, 2016

Discovered

Jun 28, 2016

Filed

vs. sector median

4 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

New Hampshire State AGbd_16a39b2d89b26ecd2016-06-28Verified
Washington State AGbd_1ea381574cf8a21d2016-06-28Candidate
Oregon State AGbd_592da2110490c72b2016-06-29 · +1dVerified

Name: NOODLES & COMPANY
norm: noodles
Domain: noodles.com

Name: NOODLES & COMPANY
norm: noodles
Domain: noodles.com
Industry: Retail & Consumerllm

Discovered: Jun 2, 2016
Breach occurred: Jan 31, 2016 – Jun 2, 2016
Undetected for: 123 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 28, 2016
Affected individuals: Not disclosed
Data types: Financial accountFinancial credentialsIdentity (basic)
Attack vector: Unknown
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Working with the United States Secret Service to investigate this incident

During the incident: Began investigating unusual activity reported by credit card processor
Working with third-party forensic experts to investigate reports and identify signs of compromise
Working with third-party forensic investigators to determine how the security compromise occurred and what information was affected
Removing the malware at issue to contain this incident and to prevent any further unauthorized access
Working with the United States Secret Service to investigate this incident
Established a dedicated assistance line for individuals seeking additional information
Changes made: Implementing additional procedures to further secure guests’ debit and credit card information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 26 days(26 days from discovery to filing)
Compliance flags: CA 60-day OK · 26d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jun 2, 2016
→ Notified: Jun 28, 2016
26d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jun 2, 2016 → Notified: Jun 28, 2016	26d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

New Hampshire State AGJun 28 · first

Washington State AGJun 28 · first

California State AGJun 28 · first · this page

Oregon State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-62596
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 28, 2016
Raw hash: 0c349c5779d69c6104d8fcd8b5a1439a5ee4a3d781186fdf7a23f825fafa46a5

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityNOODLES & COMPANY

Victim entityNOODLES & COMPANY

Incidentdiscovered Jun 2, 2016

Stated responseBegan investigating unusual activity reported by credit card processor

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov