HackingFinancial ServicesFinanceCustomer Data InvolvedIdentity (basic)MediumContained

Horicon Bank

bd_10f2b758a7ee743c · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 20, 2021

Filed

Nov 16, 2021

To disclose

26 weeks

Affected · nationwide

30,3941 in this filing

Linked

4 filings

Confidence

65%

Full breach record for Horicon Bank →

Horicon Bank, a financial services institution based in Horicon, WI, reported an external system breach (hacking) occurring on May 19, 2021, discovered on May 20, 2021. The incident affected a total of 30,394 individuals, including 1 Maine resident. The breach involved the acquisition of names and personal identifiers. The bank provided written notification to affected individuals on November 16, 2021, and offered 12 months of credit monitoring, identity restoration, and identity theft insurance through Experian.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered May 20, 2021 → Filed with AG Nov 16, 2021180d ✗ ME AG >90d26 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 1 days

discovery → filing · 26 weeks / 180 days

May 19, 2021

Begins

May 20, 2021

Discovered

Nov 16, 2021

Filed

vs. sector median

+17 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_23c8f6c3a40358792021-11-16Verified
Montana State AGbd_56f43a49c9b9e0ee2021-11-15 · +1dCandidate
New Hampshire State AGbd_1137e14623fb8bef2021-11-22 · +6dVerified

Name: Horicon Bank
norm: horicon bank
Industry: Financial Services

Name: Horicon Bank
norm: horicon bank
Industry: Financial Services
Industry: Financial Servicesllm

Discovered: May 20, 2021
Breach occurred: May 19, 2021
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Nov 16, 2021
Affected individuals: 30,394state + nationwide
Data types: Identity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: Filed data breach notice with Maine Attorney General
Initial access: exploit_public_facing

During the incident: Sent written notification to affected individuals
Offered 12 months of credit monitoring, identity restoration, and identity theft insurance by Experian
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 26 weeks(180 days from discovery to filing)
Compliance flags: ME AG >90d · 180dME resident >60d · 180d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: May 20, 2021
→ Filed with AG: Nov 16, 2021
180d 90 days ME AG >90d
Maine
Discovered: May 20, 2021
→ Notified: Nov 16, 2021
180d 60 days (analyst band; statutory cap is 30 days) ME resident >60d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: May 20, 2021 → Filed with AG: Nov 16, 2021	180d	90 days	ME AG >90d
Maine	Discovered: May 20, 2021 → Notified: Nov 16, 2021	180d	60 days (analyst band; statutory cap is 30 days)	ME resident >60d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Montana State AGNov 15 · first

Massachusetts State AG+1d

Maine State AG+1d · this page

New Hampshire State AG+7d

Pattern: first filing Nov 15 (MT), last Nov 22 (NH) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/b453fa5b-e601-476c-901f-674a30ded22f.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 16, 2021
Raw hash: b64c64c6368c9c232e1e956933bdfe07d213c8b8a3b34afcdc8ccf8158491017

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityHoricon Bank

Victim entityHoricon Bank

Incidentdiscovered May 20, 2021

Stated responseSent written notification to affected individuals

ComplianceME AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov