HackingFinancial ServicesFinanceVulnerability ExploitCL0P Ransomware GangZero-DaySupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedRansom DemandedIdentity (basic)Government IDFinancial accountHighContained

Sound Community Bank

bd_058a6e5dda99e4e8 · schema v1 · pii pii-v1

Severity

High

Discovered

Jun 13, 2023

Filed

Jul 17, 2023

To disclose

5 weeks

Affected

13,795state residents only

Linked

24 records

Confidence

70%

Sound Community Bank, a client of vendor FIS, experienced a data breach via a zero-day vulnerability in Progress Software's MOVEit Transfer tool. The CL0P ransomware group exploited the vulnerability to exfiltrate customer data including SSNs and account numbers. FIS disabled the tool and patched it on May 31, 2023. Sound Community Bank was notified on June 13, 2023, and is notifying 13,795 Washington residents, offering 2 years of credit monitoring.

J jump to incidentP pin to compareR raw source

Washington clock⏱ WA AG >30d5 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 13 days

discovery → filing · 5 weeks / 34 days

May 31, 2023

Begins

Jun 13, 2023

Discovered

Jul 17, 2023

Filed

vs. sector median

5 wks faster

This filing is one of 24 records about the same incident.View merged incident

Part of Progress Software Corporation supply-chain incident (2023) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Massachusetts State AGbd_51d45a1a8a5e2f6d2023-09-19 · +64dVerified by operator
Massachusetts State AGbd_ec926ee5ee55bfe72023-09-19 · +64dVerified by operator
Montana State AGbd_9d135722f356e9262023-09-28 · +73dVerified
Oregon State AGbd_c13bfda88a3242d42023-10-04 · +79dVerified

Show 6 more filings ↓up to 126d gap

California State AGbd_c92fcc25ac8a7c682023-10-04 · +79dVerified
Massachusetts State AGbd_d77a46d0383bceaa2023-10-04 · +79dVerified by operator
Massachusetts State AGbd_a9a8d5c26793cdfc2023-10-06 · +81dVerified by operator
California State AGbd_7d8643b052109cd42023-11-09 · +115dVerified by operator
Massachusetts State AGbd_e1c74fd96247ece32023-11-09 · +115dVerified by operator
Massachusetts State AGbd_c89fcdf92f5fe80d2023-11-20 · +126dVerified by operator

Showing first 10 of 23 linked disclosures.

Name: FIDELITY NATIONAL INFORMATION SERVICES, INC.
norm: fidelity national information
Domain: fisglobal.com

Name: Sound Community Bank
norm: sound community bank
Domain: fisglobal.com
Industry: Financial Servicesllm

Discovered: Jun 13, 2023
Breach occurred: May 31, 2023 – Jun 1, 2023
Undetected for: 13 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 18, 2023
Affected individuals: 13,795state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: NameSocial Security numberFinancial account numberDate of birth
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found after the fact
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: CL0P Ransomware GangExternalFinancial
Regulator citations: Notified law enforcement
Initial access: exploit_public_facing

During the incident: FIS immediately ceased using MOVEit Transfer and disabled it in its system
FIS successfully deployed patches on all instances of the MOVEit Transfer applications
FIS immediately launched an investigation with the assistance of cyber experts
FIS notified law enforcement
FIS notified Sound Community Bank of the potential impact
Sound Community Bank is sending notifications by email to the affected individuals
FIS and Sound Community Bank are offering two years of credit monitoring to affected customers
Changes made: FIS is taking steps to further secure its use of all third-party transfer tools
FIS will continue to carefully evaluate the cybersecurity posture of third-party file transfer tools
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(34 days from discovery to filing)
Compliance flags: WA AG >30d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 5 states

View merged incident ↗

Washington State AGJul 17 · first · this page

Massachusetts State AG+64d

Montana State AG+73d

Oregon State AG+79d

California State AG+79d

Massachusetts State AG+79d

Massachusetts State AG+81d

California State AG+115d

Massachusetts State AG+115d

Massachusetts State AG+126d

Pattern: first filing Jul 17 (WA), last Nov 20 (MA) — a 126-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 23 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM15357.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 17, 2023
Raw hash: e757773766bcc6edda7b0270f9bfa733103a8a08156d7cf4791dd522551a2cd3

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityFIDELITY NATIONAL INFORMATION SERVICES, INC.

Victim entitySound Community Bank

Incidentdiscovered Jun 13, 2023

Stated responseFIS immediately ceased using MOVEit Transfer and disabled it in its system

ComplianceWA AG >30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com