HackingCustomer Data InvolvedData ExfiltratedIDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTHighContained
The Old Point National Bank of Phoebus
bd_10e547fa1388b925 · schema v1 · pii pii-v1
Full breach record for The Old Point National Bank of Phoebus →Old Point National Bank experienced a data breach where an unauthorized party gained access to a business email account on or around September 2, 2022. The incident, discovered the following day, potentially exposed the personal information of 16,496 loan applicants, including names, Social Security numbers, driver's license numbers, and bank account details. The bank has notified affected individuals, engaged external cybersecurity experts, is cooperating with law enforcement agencies, and is offering one year of complimentary credit monitoring services.
Maine clockDiscovered Sep 3, 2022 → Filed with AG Nov 9, 202267d ⏱ ME AG >30d10 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 3 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (2) · sorted by filing gap
- bd_2479445bced6fac8Montana State AGfiled 2022-11-09Verified
- bd_9ff4fe7fa56f0ef4Idaho State AGfiled 2022-11-30(21d gap)Verified
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/fb8d794d-65f8-4885-aace-195a5c9f06b8.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Nov 9, 2022
- Raw hash
- 51f39c18584bea61ae8588edb915a713cbcd953ef40610b95cda082fc0660a08
Reporting entity
- Name
- The Old Point National Bank of Phoebusnorm: the old point national bank of phoebus
- Domain
- oldpoint.com
Victim entity
- Name
- The Old Point National Bank of Phoebusnorm: the old point national bank of phoebus
- Domain
- oldpoint.com
Incident
- Discovered
- Sep 3, 2022
- Materiality determined
- —
- Notification sent
- Nov 8, 2022
- Affected individuals
- 16,496
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1114 Email CollectionT1078 Valid Accounts
- Threat actor
- External
Compliance
- Time to disclose
- 10 weeks(67 days from discovery to filing)
- Compliance flags
- ME AG >30d · 67dME resident >60d · 66d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Sep 3, 2022→ Filed with AG: Nov 9, 202267d 30 days (soft) ME AG >30d Maine Discovered: Sep 3, 2022→ Notified: Nov 8, 202266d 60 days (analyst band; statutory cap is 30 days) ME resident >60d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.