HackingFinancial ServicesFinanceVulnerability ExploitSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedPIIIdentity (basic)Government IDCVE-2023-34362MediumContained

CNB Bank & Trust, N.A.

bd_18a16db520429363 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Nov 15, 2023

To disclose

—

Affected

5state residents only

Linked

3 filings

Confidence

66%

Full breach record for CNB Bank & Trust, N.A. →2 incidents on file

CNB Bank & Trust, N.A. notified customers of a data breach involving third-party provider Fiserv. Unauthorized actors exploited a vulnerability in MOVEit Transfer software between May 27-31, 2023, accessing files containing personal information. CNB systems were not directly involved. Affected individuals received two years of identity monitoring via Kroll.

J jump to incidentP pin to compareR raw source

Incident timeline

May 27, 2023

Begins

Nov 15, 2023

Filed

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Maine State AGbd_cff98f1b1cb861822023-11-15Candidate
Massachusetts State AGbd_d458f4feb94e180b2023-11-15Verified

Name: CNB Bank & Trust, N.A.
norm: cnb bank trust na

Name: CNB Bank & Trust, N.A.
norm: cnb bank trust na
Industry: Financial Servicesllm

Discovered: —
Breach occurred: May 27, 2023 – May 31, 2023
Materiality determined: —
Notification sent: —
Affected individuals: 5state-resident count only
Data types: PIIIdentity (basic)Government ID
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Third party: via Fiserv
Initial access: exploit_public_facing
CVE references: CVE-2023-34362

During the incident: Service provider remediated all technical vulnerabilities and patched systems in accordance with the MOVEit software provider’s guidelines
Service provider mobilized a technical response team to examine the relevant MOVEit Transfer systems
Arranged for free identity monitoring services through Kroll for two years
Changes made: Remediated all technical vulnerabilities
Patched systems in accordance with the MOVEit software provider’s guidelines
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Maine State AGNov 15 · first

Massachusetts State AGNov 15 · first

Montana State AGNov 15 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-848.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 15, 2023
Raw hash: 865bc254d1c2b443d4d4b20ed9db285efaf6d25bb977ee49154d1d8eb50cc533

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityCNB Bank & Trust, N.A.

Victim entityCNB Bank & Trust, N.A.

IncidentThird-Party / Supply Chain

Stated responseService provider remediated all technical vulnerabilities and patched systems in accordance with the MOVEit software provider’s guidelines

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov