Rosenthal Wine Shop

Summary

Rosenthal Wine Shop experienced a malware intrusion affecting systems processing customer payment card transactions, potentially compromising names, addresses, account numbers, expiration dates, and security codes. The company contained the incident by implementing advanced malware protection, reformatting impacted systems, and offered affected customers complimentary identity monitoring services to address potential misuse of personal information.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On January 12, 2014, Rosenthal Wine Shop (operating as Castle Creek Properties, Inc., dba Rosenthal the Malibu Estates) discovered unauthorized individuals or entities had installed malicious software on computer systems used to process credit card transactions at its wine shop tasting room. The malware potentially compromised payment card data of customers who made purchases at the physical location, including names, addresses, payment card account numbers, expiration dates, and security codes. The company acknowledged uncertainty regarding whether specific customer data had been misused but initiated precautionary notifications to inform customers of the breach. The incident exclusively affected point-of-sale systems in the tasting room, with no indication of broader network compromise beyond payment processing infrastructure. Rosenthal Wine Shop confirmed the malware's purpose was to capture payment card details during transaction processing, though forensic analysis did not establish definitive evidence of data exfiltration or misuse.

On January 23, 2014, Rosenthal Wine Shop contained the incident by installing advanced malware protection and eradication systems while reformatting all affected point-of-sale devices. The company notified customers through direct communications and public disclosure, advising them to review credit/debit card statements for discrepancies or suspicious activity and to monitor accounts for unusual transactions. As a remedial measure, Rosenthal offered affected customers a complimentary one-year membership to Experian’s ProtectMyID® Alert service for identity monitoring, though enrollment required proactive contact via a dedicated phone number. The breach notification emphasized checking credit reports for unauthorized accounts, inaccurate personal information, or unrecognized creditor inquiries, recommending direct contact with financial institutions and credit agencies if anomalies were detected. No law enforcement actions or regulatory fines were disclosed in the source material, and the company expressed regret for potential inconveniences while asserting ongoing security improvements to prevent recurrence.

Sources

Sources available to members: 1 source.