HackingFinancial ServicesFinanceStolen CredentialsTargetedPIIIdentity (basic)Government IDMediumContained

Central Bank

bd_0dfb21d970bf0ff1 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Mar 8, 2022

To disclose

—

Affected

1state residents only

Linked

5 filings

Confidence

65%

Full breach record for Central Bank →2 incidents on file

Central Bank notified Montana residents of a security incident where an unauthorized person accessed files on servers on December 27, 2021. The incident involved personal information including SSNs. The bank engaged law enforcement and a cybersecurity firm, contained the incident, and offered one year of Kroll credit monitoring services.

J jump to incidentP pin to compareR raw source

Incident timeline

Dec 27, 2021

Begins

Mar 8, 2022

Filed

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Massachusetts State AGbd_0d50b1a0eb5cb0212022-03-08Verified
Maine State AGbd_a9865f0b5abc45f02022-03-08Verified
New Hampshire State AGbd_ab52fad5322dc7c82022-03-08Verified
Indiana State AGbd_c834f0934f07b56f2022-03-08Verified

Name: Central Bank
norm: central bank
Domain: centralbank.com

Name: Central Bank
norm: central bank
Domain: centralbank.com
Industry: Financial Servicesllm

Discovered: —
Breach occurred: Dec 27, 2021
Materiality determined: —
Notification sent: —
Affected individuals: 1state-resident count only
Data types: PIIIdentity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Initial access: valid_credentials

During the incident: Took steps to secure our environment and contain the incident
Contacted law enforcement
Began an investigation with the assistance of an outside cybersecurity firm
Offering you a complimentary one-year membership in Kroll’s credit and identity monitoring services
Changes made: Additional steps are being taken to further enhance our existing security measures
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Massachusetts State AGMar 8 · first

Maine State AGMar 8 · first

New Hampshire State AGMar 8 · first

Indiana State AGMar 8 · first

Montana State AGMar 8 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-Notification-Letter-250.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 8, 2022
Raw hash: 08c0c4f81835c05835cac4873c44c8ad3caafd8b52e4964360afdab2231f24a5

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityCentral Bank

Victim entityCentral Bank

IncidentUnauthorized Access

Stated responseTook steps to secure our environment and contain the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov