HackingRetail & ConsumerRetailData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

Restaurant Management Company of Wichita, Inc.

bd_f67f346db1f6ee32 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 13, 2025

Filed

Apr 20, 2026

To disclose

27 weeks

Affected

20state residents only

Linked

9 filings

Confidence

66%

Full breach record for Restaurant Management Company of Wichita, Inc. →

Restaurant Management Company of Wichita, Inc. notified the New Hampshire Attorney General of a security incident affecting 20 NH residents. Unauthorized access occurred between October 4 and October 13, 2025. The breach exposed names, addresses, DOBs, SSNs, driver's license numbers, and financial account details. RMC engaged forensic investigators and outside counsel, reset passwords, rebuilt servers, and provided one year of Experian credit monitoring to affected individuals. Notices were mailed starting April 20, 2026.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 9 days

discovery → filing · 27 weeks / 189 days

Oct 4, 2025

Begins

Oct 13, 2025

Discovered

Apr 20, 2026

Filed

vs. sector median

+20 wks slower

This filing is one of 9 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (8) · sorted by filing gap

Nebraska State AGbd_323451e434d739292026-04-20Verified
Indiana State AGbd_4197eb822c7b92812026-04-20Candidate
Indiana State AGbd_5035bd5b08d071f02026-04-20Candidate
Maine State AGbd_8e2220c9a2d14a402026-04-20Verified by operator

Show 4 more filings ↓up to 21d gap

Montana State AGbd_b616db262f0d737e2026-04-20Verified
Texas State AGbd_b63d164a416d9d162026-04-22 · +2dVerified by operator
Vermont State AGbd_57e52e0fce5fc9012026-04-17 · +3dVerified
Massachusetts State AGbd_dd5cc7ea04c6bf0e2026-05-11 · +21dVerified by operator

Name: Restaurant Management Company of Wichita, Inc.
norm: restaurant management company of wichita

Name: Restaurant Management Company of Wichita, Inc.
norm: restaurant management company of wichita
Industry: Retail & Consumerllm

Discovered: Oct 13, 2025
Breach occurred: Oct 4, 2025 – Oct 13, 2025
Undetected for: 9 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 20, 2026
Affected individuals: 20state-resident count only
Data types: Identity (basic)Government IDFinancial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Initial access: exploit_public_facing

During the incident: Engaged Shook, Hardy & Bacon as outside counsel
Engaged a leading digital-forensics firm to assist in the investigation
Took steps to begin investigating the incident and securing its environment
Engaged a data-review firm to review the content of those files
Started mailing written notices to affected individuals
Established a toll-free call center
Reset passwords
Rebuilt the affected servers
Adopted additional technical safeguards
Changes made: Adopted additional technical safeguards
Maintained existing data security infrastructure including firewalls, multifactor authentication, and endpoint detection and response
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 27 weeks(189 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 8 states

View merged incident ↗

Vermont State AGApr 17 · first

New Hampshire State AG+3d · this page

Texas State AG+5d

Massachusetts State AG+24d

Pattern: first filing Apr 17 (VT), last May 11 (MA) — a 24-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/restaurant-management-company-wichita-20260420.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 20, 2026
Raw hash: a0bb8bd9c1cea52b2abd9d0fe130fd471540c9fe0365fb42bfbdd1fcf0b9b8e4

Linked disclosures

Regulatory filings (8) · sorted by filing gap

Reporting entityRestaurant Management Company of Wichita, Inc.

Victim entityRestaurant Management Company of Wichita, Inc.

Incidentdiscovered Oct 13, 2025

Stated responseEngaged Shook, Hardy & Bacon as outside counsel

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov