HackingFinancial ServicesFinanceStolen CredentialsSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountHighContained

Flagstar Bank, National Association

bd_250cebdc817084c3 · schema v1 · pii pii-v1

Severity

High

Discovered

Jan 24, 2021

Filed

Mar 12, 2021

To disclose

7 weeks

Affected

3,755state residents only

Linked

8 filings

Confidence

66%

Full breach record for Flagstar Bank, National Association →7 incidents on file

Flagstar Bank, FSB notified the New Hampshire Attorney General of a data breach involving its third-party file-sharing vendor, Accellion. The incident, discovered on January 24, 2021, exposed personal information of 3,755 NH residents, including names, SSNs, dates of birth, and financial account numbers. Flagstar discontinued the platform, engaged forensic experts, and provided two years of free credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 2 days

discovery → filing · 7 weeks / 47 days

Jan 22, 2021

Begins

Jan 24, 2021

Discovered

Mar 12, 2021

Filed

vs. sector median

3 wks faster

This filing is one of 8 filings about the same incident.View merged incident

Part of Accellion supply-chain incident (2021) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

Massachusetts State AGbd_34345641741391fa2021-03-15 · +3dVerified
Indiana State AGbd_4ac063fe07397ef92021-03-15 · +3dVerified
California State AGbd_4d259a5e238333b32021-03-15 · +3dVerified
Oregon State AGbd_74b910abb5f0a7242021-03-15 · +3dCandidate

Show 3 more filings ↓up to 3d gap

Montana State AGbd_99bd7b6b318401122021-03-15 · +3dVerified
Maine State AGbd_9ac79c69f97945562021-03-15 · +3dVerified
Washington State AGbd_e0acf0e4ea72fff32021-03-15 · +3dVerified

Name: SKADDEN, ARPS, SLATE, MEAGHER & FLOM LLP
norm: skadden arps slate meagher flom

Name: Flagstar Bank, National Association
norm: flagstar bank national
Industry: Financial Servicesllm

Discovered: Jan 24, 2021
Breach occurred: Jan 22, 2021
Undetected for: 2 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 15, 2021
Affected individuals: 3,755state-resident count only
Data types: Identity (basic)Government IDFinancial account
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: Notified New Hampshire Department of Justice Office of the Attorney General
Third party: via Accellion
Initial access: supply_chain

During the incident: Discontinued use of the Accellion platform
Transitioned to another cloud-based product
Deployed additional detection and response tools across the Company’s network
Engaged a team of third-party forensic experts to investigate
Notified law enforcement
Changes made: Arranged to make credit monitoring and identity repair services available to affected residents at no cost for two years
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(47 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 8 states

View merged incident ↗

New Hampshire State AGMar 12 · first · this page

Massachusetts State AG+3d

Indiana State AG+3d

California State AG+3d

Oregon State AG+3d

Montana State AG+3d

Maine State AG+3d

Washington State AG+3d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/flagstar-bank-20210312.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 12, 2021
Raw hash: 4a54a3e7505adae0fe4b10b44f8582a6b99185938c45501a0d73e7fb2c7a2bb1

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entitySKADDEN, ARPS, SLATE, MEAGHER & FLOM LLP

Victim entityFlagstar Bank, National Association

Incidentdiscovered Jan 24, 2021

Stated responseDiscontinued use of the Accellion platform

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov