Social EngineeringFinancial ServicesFinancePhishingStolen CredentialsCustomer Data InvolvedTargetedIdentity (basic)Government IDMediumContained

Limestone Bank, Inc.

bd_205d103bb61afbcd · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 23, 2023

Filed

Sep 15, 2023

To disclose

25 weeks

Affected

20state residents only

Linked

6 filings

Confidence

66%

Full breach record for Limestone Bank, Inc. →

Limestone Bank (now Peoples Bank) notified individuals of a phishing incident targeting an employee email account between Nov 21, 2022 and Mar 23, 2023. The attacker accessed emails containing names and government IDs. The bank secured the account, engaged forensic help, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 122 days

discovery → filing · 25 weeks / 176 days

Nov 21, 2022

Begins

Mar 23, 2023

Discovered

Sep 15, 2023

Filed

vs. sector median

+17 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Indiana State AGbd_479cf63665e980622023-09-15Verified
Maine State AGbd_5d3b964d889a8c142023-09-15Verified
Massachusetts State AGbd_67b3b5c396b298342023-09-15Verified
New Hampshire State AGbd_c83686cdeac36a3f2023-09-15Verified

Show 1 more filing ↓

Vermont State AGbd_e69f36a77ffb01dd2023-09-15Verified

Name: Limestone Bank, Inc.
norm: limestone bank

Name: Limestone Bank, Inc.
norm: limestone bank
Industry: Financial Servicesllm

Discovered: Mar 23, 2023
Breach occurred: Nov 21, 2022 – Mar 23, 2023
Undetected for: 122 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 20state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Initial access: phishing_link

During the incident: Engaged a cybersecurity firm to assist with the investigation
Secured the compromised email account
Offered credit monitoring and identity protection services through Equifax CompleteTM Premier
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 25 weeks(176 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Indiana State AGSep 15 · first

Maine State AGSep 15 · first

Massachusetts State AGSep 15 · first

New Hampshire State AGSep 15 · first

Vermont State AGSep 15 · first

Montana State AGSep 15 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-680.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 15, 2023
Raw hash: afafe39b245ac92d42c4bc092b0fb9f268fd3ac9821459acecc6563daba5463f

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityLimestone Bank, Inc.

Victim entityLimestone Bank, Inc.

Incidentdiscovered Mar 23, 2023

Stated responseEngaged a cybersecurity firm to assist with the investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov