HackingFinancial ServicesFinanceStolen CredentialsTargetedIdentity (basic)Government IDFinancial accountMediumContained

The Old Point National Bank of Phoebus

bd_2479445bced6fac8 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Nov 9, 2022

To disclose

—

Affected

5state residents only

Linked

6 filings

Confidence

65%

Full breach record for The Old Point National Bank of Phoebus →

Old Point National Bank notified Montana residents of a cybersecurity incident involving unauthorized remote access to a business email account on or about September 2, 2022. The incident may have exposed customer names, driver's licenses, SSNs, and account numbers. The bank engaged cybersecurity experts and law enforcement (FBI, DHS, Virginia State Police) and implemented additional security protocols.

J jump to incidentP pin to compareR raw source

Incident timeline

Sep 2, 2022

Begins

Nov 9, 2022

Filed

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Maine State AGbd_10e547fa1388b9252022-11-09Candidate
Massachusetts State AGbd_267831472cbd4fcd2022-11-09Verified
Indiana State AGbd_55270be59aa6bdef2022-11-30 · +21dVerified
Idaho State AGbd_9ff4fe7fa56f0ef42022-11-30 · +21dVerified

Show 1 more filing ↓up to 26d gap

New Hampshire State AGbd_58b765261ff7013f2022-12-05 · +26dVerified

Name: The Old Point National Bank of Phoebus
norm: the old point national bank of phoebus
Domain: oldpoint.com

Name: The Old Point National Bank of Phoebus
norm: the old point national bank of phoebus
Domain: oldpoint.com
Industry: Financial Servicesllm

Discovered: —
Breach occurred: Sep 2, 2022
Materiality determined: —
Notification sent: —
Affected individuals: 5state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Reported the incident to the Virginia State Police High Tech Crimes UnitReported the incident to the Department of Homeland Security’s Cybersecurity and Infrastructure Security AgencyReported the incident to the FBI Cyber Crimes Division
Initial access: valid_credentials

During the incident: Engaged leading outside cybersecurity experts
Reported the incident to the appropriate law enforcement authorities including the Virginia State Police High Tech Crimes Unit, the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency, and the FBI Cyber Crimes Division
Cooperating in the investigation of these incidents by law enforcement
Put in place extra procedures and protocols to help protect your information
Implemented further security protocols designed to further protect our network, email environment, systems, and customer personal information
Changes made: Implemented further security protocols designed to further protect our network, email environment, systems, and customer personal information
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Maine State AGNov 9 · first

Massachusetts State AGNov 9 · first

Montana State AGNov 9 · first · this page

Indiana State AG+21d

Idaho State AG+21d

New Hampshire State AG+26d

Pattern: first filing Nov 9 (ME), last Dec 5 (NH) — a 26-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-Notification-Letter-700.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 9, 2022
Raw hash: 6adc99782a3507bcda3d78b33ac59a8b2ce84d780c169df0786bf96c120d6509

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityThe Old Point National Bank of Phoebus

Victim entityThe Old Point National Bank of Phoebus

IncidentUnauthorized Access

Stated responseEngaged leading outside cybersecurity experts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov