HackingVulnerability ExploitCapture Stored DataData ExfiltratedCustomer Data InvolvedSupply Chain (3P Vendor)PIIIDENTITY_BASICLowContained
Stockman Bank of Montana
bd_035aefcad4f9f044 · schema v1 · pii pii-v1
Full breach record for Stockman Bank of Montana →Stockman Bank notified the New Hampshire Attorney General of a security incident involving one resident. Unauthorized access occurred May 30-31, 2023, via a vulnerability in the MOVEit file transfer tool used by vendor Progress Software. Personal information (name, etc.) of one NH resident was exfiltrated. Stockman engaged forensic investigators, implemented mitigations, and offered credit monitoring.
This filing is one of 3 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (2) · sorted by filing gap
- bd_353f8ae784f3b6b8Montana State AGfiled 2023-08-08Candidate
- bd_3facb6f42c9113c1Maine State AGfiled 2023-08-08Verified
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/stockman-bank-20230808.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Aug 8, 2023
- Raw hash
- 144e4860c4b6104c7b960d1217c776b181321d923c426b24b5849dbb89bb1fda
Reporting entity
- Name
- Stockman Bank of Montananorm: stockman bank of montana
Victim entity
- Name
- Stockman Bank of Montananorm: stockman bank of montana
Incident
- Discovered
- May 31, 2023
- Materiality determined
- Aug 4, 2023
- Notification sent
- Aug 7, 2023
- Affected individuals
- 1
- Data types
- PIIIDENTITY_BASIC
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
- Threat actor
- ExternalFinancial
- Regulator citations
- Notified Attorney General John Formella
- Third party
- via Progress Software
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 10 weeks(69 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.