HackingVulnerability ExploitZero-DayData ExfiltratedCustomer Data InvolvedIDENTITY_GOVERNMENTIDENTITY_BASICMediumContained

Crescent Bank

bd_255e1264a38fcb37 · schema v1 · pii pii-v1

Full breach record for Crescent Bank →

Financial Institution Service Corporation (FISC) notified New Hampshire residents that an unknown actor exploited zero-day vulnerabilities in the MOVEit Transfer server between May 30 and May 31, 2023, to exfiltrate data belonging to Crescent Bank members. Approximately 251 New Hampshire residents were affected. FISC reported the incident to federal law enforcement, provided credit monitoring via Kroll, and established a call center for affected individuals.

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed251 affectedView incident

Source provenance

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/financial-institution-service-corporation-20230928.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 28, 2023
Raw hash: 47d56f3189894a2611296f3e61618cf0cc274e4c6a6284403267b0302524febc

Reporting entity

Name: Financial Institution Service Corporation
norm: financial institution service
Domain: fiscdp.com

Victim entity

Name: Crescent Bank
norm: crescent bank

Incident

Discovered: May 31, 2023
Materiality determined: —
Notification sent: Sep 22, 2023
Affected individuals: 251
Data types: IDENTITY_GOVERNMENTIDENTITY_BASIC
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: promptly reported the event to federal law enforcement and its primary federal regulators
Initial access: exploit_public_facing

Compliance

Time to disclose: 17 weeks(120 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Extraction provenance

Status: No extraction artifact recorded for this disclosure.