HackingVulnerability ExploitZero-DaySupply Chain (Dependency)Delayed DiscoveryCustomer Data InvolvedData ExfiltratedIDENTITY_BASICIDENTITY_GOVERNMENTHighActive
First Hartford Bancshares
bd_0332f161a4dc591f · schema v1 · pii pii-v1
Full breach record for First Hartford Bancshares →First National Bank of Hartford, a subsidiary of First Hartford Bancshares, Inc., reported a data breach resulting from a previously unknown vulnerability in the MOVEit Transfer software. Between May 27, 2023, and May 29, 2023, an unauthorized party accessed systems and may have acquired files containing sensitive information. The breach, which was discovered on February 14, 2024, affected 5,316 individuals, exposing names and Social Security numbers. The bank is offering complimentary credit monitoring services.
Maine clockDiscovered Feb 14, 2024 → Filed with AG Feb 27, 202413d ✓ ME AG ≤30d13 days discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 4 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (3) · sorted by filing gap
- bd_069ff37cfdde6e9cIndiana State AGfiled 2024-02-26(1d gap)Verified
- bd_3b9789b3324122e1Montana State AGfiled 2024-02-26(1d gap)Candidate
- bd_ac5dc146c1739527New Hampshire State AGfiled 2024-02-26(1d gap)Verified
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/e1e8a6de-81ff-4e44-93e4-cc831dfd0d44.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Feb 27, 2024
- Raw hash
- 61d1609a16ecc9e42442ed55d40d2045e79ef0fdf1ae02b782ebe92533e8b6e4
Reporting entity
- Name
- First Hartford Bancsharesnorm: first hartford bancshares
Victim entity
- Name
- First Hartford Bancsharesnorm: first hartford bancshares
Incident
- Discovered
- Feb 14, 2024
- Materiality determined
- —
- Notification sent
- Feb 26, 2024
- Affected individuals
- 5,316
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing Application
- Threat actor
- External
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 13 days(13 days from discovery to filing)
- Compliance flags
- ME AG ≤30d · 13d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Feb 14, 2024→ Filed with AG: Feb 27, 202413d 30 days ME AG ≤30d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.