HackingFinancial ServicesFinanceVulnerability ExploitData ExfiltratedTargetedPIIIdentity (basic)Financial accountLowContained

Great Plains State Bank

bd_1fb30f5f9e180a5a · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Oct 3, 2023

To disclose

—

Affected

1state residents only

Linked

2 filings

Confidence

66%

Full breach record for Great Plains State Bank →3 incidents on file

Great Plains State Bank notified customers of a data breach involving its core banking provider's use of MOVEit Transfer software. Unauthorized access occurred between May 27-31, 2023, exploiting vulnerabilities in the software. Personal information, including names and financial account details, was accessed. The bank remediated vulnerabilities, engaged forensic investigation, and provided two years of identity monitoring via Kroll.

J jump to incidentP pin to compareR raw source

Incident timeline

May 27, 2023

Begins

Oct 3, 2023

Filed

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Indiana State AGbd_a21b8791444ab1d52023-09-11 · +22dVerified

Name: Great Plains State Bank
norm: great plains state bank
Domain: gpbankok.com

Name: Great Plains State Bank
norm: great plains state bank
Domain: gpbankok.com
Industry: Financial Servicesllm

Discovered: —
Breach occurred: May 27, 2023 – May 31, 2023
Materiality determined: —
Notification sent: —
Affected individuals: 1state-resident count only
Data types: PIIIdentity (basic)Financial account
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: notified regulatory bodies as required
Third party: via Core Banking Provider
Initial access: exploit_public_facing

During the incident: Launched a comprehensive investigation
Remediated all technical vulnerabilities and patched systems
Mobilized a technical response team to examine the relevant MOVEit Transfer systems
Notified regulatory bodies
Arranged for complimentary free identity monitoring service through Kroll for two years
Changes made: Remediated all technical vulnerabilities and patched systems in accordance with the MOVEit software provider’s guidelines
Mobilized a technical response team to examine the relevant MOVEit Transfer systems and ensure that there were no further vulnerabilities
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Indiana State AGSep 11 · first

Montana State AG+22d · this page

Pattern: first filing Sep 11 (IN), last Oct 3 (MT) — a 22-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-744.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 3, 2023
Raw hash: 0d32ea6e93c042d44a80d336b24b1d61302c656c3422b2a9c4ef2e130f59ee83

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityGreat Plains State Bank

Victim entityGreat Plains State Bank

IncidentThird-Party / Supply Chain

Stated responseLaunched a comprehensive investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov