AccidentalFinancial ServicesFinanceMisconfigurationCustomer Data InvolvedIdentity (basic)Financial accountMediumResolved

Arvest Bank

bd_04cbfdb0ec5567b5 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 24, 2025

Filed

May 12, 2025

To disclose

18 days

Affected · nationwide

7,5374 in this filing

Linked

5 filings

Confidence

66%

Full breach record for Arvest Bank →4 incidents on file

Arvest Bank disclosed a data breach occurring on April 24, 2025, where a technical issue during routine system updates temporarily allowed customers to view other customers' account information. The incident affected 7,737 individuals nationwide, including 4 in Maine. Compromised data included names, account numbers, balances, and activity. Arvest Bank resolved the issue by April 25, 2025, and offered 12 months of credit monitoring and identity theft recovery services to affected customers.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Apr 24, 2025 → Filed with AG May 12, 202518d ✓ ME AG ≤30d18 days discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 18 days

Apr 24, 2025

Begins

Apr 24, 2025

Discovered

May 12, 2025

Filed

vs. sector median

6 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Indiana State AGbd_d0a61da95843881f2025-05-09 · +3dVerified
Nebraska State AGbd_f8dee04fc3f8275b2025-05-09 · +3dVerified
Indiana State AGbd_579edf1c4045581b2025-05-30 · +18dCandidate
Nebraska State AGbd_e1bed42dae8c79502025-05-30 · +18dVerified

Name: Arvest Bank
norm: arvest bank
Domain: arvest.com
Industry: Financial Services

Name: Arvest Bank
norm: arvest bank
Domain: arvest.com
Industry: Financial Services
Industry: Financial Servicesllm

Discovered: Apr 24, 2025
Breach occurred: Apr 24, 2025 – Apr 24, 2025
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 9, 2025
Affected individuals: 7,537state + nationwide
Data types: Identity (basic)Financial account
Attack vector: Misconfiguration
MITRE ATT&CK: T1119 Automated Collection
Regulator citations: Filed notification with Maine Attorney General

During the incident: Temporarily disabled some online banking functions until the issue was fixed
Providing Credit Monitoring and Fully Managed Identity Theft Recovery coverage to all customers with affected accounts
Changes made: Temporarily disabled some online banking functions until the issue was fixed
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 18 days(18 days from discovery to filing)
Compliance flags: ME AG ≤30d · 18d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Apr 24, 2025
→ Filed with AG: May 12, 2025
18d 30 days ME AG ≤30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Apr 24, 2025 → Filed with AG: May 12, 2025	18d	30 days	ME AG ≤30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 3 states

View merged incident ↗

Indiana State AGMay 9 · first

Nebraska State AGMay 9 · first

Maine State AG+3d · this page

Indiana State AG+21d

Nebraska State AG+21d

Pattern: first filing May 9 (IN), last May 30 (NE) — a 21-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/fc5718dc-54be-4113-be02-0519ede89840.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 12, 2025
Raw hash: ab47b070725523aa4f031ee6c32fa4bf8d542279b9dd196659bea35b537f215d

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityArvest Bank

Victim entityArvest Bank

Incidentdiscovered Apr 24, 2025

Stated responseTemporarily disabled some online banking functions until the issue was fixed

ComplianceME AG ≤30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov