HackingFinancial ServicesFinanceVulnerability ExploitZero-DaySupply Chain (Dependency)Delayed DiscoveryCustomer Data InvolvedData ExfiltratedIdentity (basic)Government IDHighActive

First Hartford Bancshares

bd_0332f161a4dc591f · schema v1 · pii pii-v1

Severity

High

Discovered

Feb 14, 2024

Filed

Feb 27, 2024

To disclose

13 days

Affected · nationwide

5,3161 in this filing

Linked

5 filings

Confidence

65%

Full breach record for First Hartford Bancshares →

First National Bank of Hartford, a subsidiary of First Hartford Bancshares, Inc., reported a data breach resulting from a previously unknown vulnerability in the MOVEit Transfer software. Between May 27, 2023, and May 29, 2023, an unauthorized party accessed systems and may have acquired files containing sensitive information. The breach, which was discovered on February 14, 2024, affected 5,316 individuals, exposing names and Social Security numbers. The bank is offering complimentary credit monitoring services.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Feb 14, 2024 → Filed with AG Feb 27, 202413d ✓ ME AG ≤30d13 days discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 263 days

discovery → filing · 13 days

May 27, 2023

Begins

Feb 14, 2024

Discovered

Feb 27, 2024

Filed

vs. sector median

7 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Massachusetts State AGbd_6abc587fb83d733f2024-02-27Verified
Indiana State AGbd_069ff37cfdde6e9c2024-02-26 · +1dVerified
Montana State AGbd_3b9789b3324122e12024-02-26 · +1dCandidate
New Hampshire State AGbd_ac5dc146c17395272024-02-26 · +1dVerified

Name: First Hartford Bancshares
norm: first hartford bancshares

Name: First Hartford Bancshares
norm: first hartford bancshares
Also named: First Hartford Bancshares, Inc.dba oflegal entity
First National Bank of Hartforddba oftrade name
Industry: Financial Servicesllm

Discovered: Feb 14, 2024
Breach occurred: May 27, 2023
Undetected for: 263 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 26, 2024
Affected individuals: 5,316state + nationwide
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Initial access: exploit_public_facing

During the incident: Secured its systems
Engaged a specialized cybersecurity firm to investigate
Offered complimentary credit monitoring and identity theft restoration services through Kroll
Changes made: Enhanced the security of its systems to protect against similar incidents
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 days(13 days from discovery to filing)
Compliance flags: ME AG ≤30d · 13d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Feb 14, 2024
→ Filed with AG: Feb 27, 2024
13d 30 days ME AG ≤30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Feb 14, 2024 → Filed with AG: Feb 27, 2024	13d	30 days	ME AG ≤30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Indiana State AGFeb 26 · first

Montana State AGFeb 26 · first

New Hampshire State AGFeb 26 · first

Massachusetts State AG+1d

Maine State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/e1e8a6de-81ff-4e44-93e4-cc831dfd0d44.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 27, 2024
Raw hash: 61d1609a16ecc9e42442ed55d40d2045e79ef0fdf1ae02b782ebe92533e8b6e4

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityFirst Hartford Bancshares

Victim entityFirst Hartford Bancshares

Incidentdiscovered Feb 14, 2024

Stated responseSecured its systems

ComplianceME AG ≤30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov