HackingCustomer Data InvolvedIDENTITY_GOVERNMENTIDENTITY_BASICHighContained
BANK OF AMERICA CORPORATION
bd_25d11105fb79a226 · schema v1 · pii pii-v1
Full breach record for BANK OF AMERICA CORPORATION →Bank of America, N.A. reported an external system breach (hacking) occurring on October 29, 2023, discovered on October 30, 2023. The incident affected 57,028 individuals nationwide, including 93 Maine residents. Personal information acquired included names and Social Security Numbers. Bank of America provided written notification and offered 24 months of complimentary identity theft protection services via Experian.
Maine clockDiscovered Oct 30, 2023 → Filed with AG Feb 2, 202495d ✗ ME AG >90d14 weeks discovery → filing
⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed57,028 affectedView incident
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/c2da936e-14f0-421a-833e-a24cbdd79cfa.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Feb 2, 2024
- Raw hash
- fbfdd1850bcbf9e2aea36c6e8cdcd7ecdaa61d598761ed00e1fb9b3f173a874a
Reporting entity
- Name
- INFOSYS MCCAMISH SYSTEMS, LLCnorm: infosys mccamish
Victim entity
- Name
- BANK OF AMERICA CORPORATIONnorm: bank of america
- Domain
- bankofamerica.com
Incident
- Discovered
- Oct 30, 2023
- Materiality determined
- —
- Notification sent
- Feb 1, 2024
- Affected individuals
- 57,028
- Data types
- IDENTITY_GOVERNMENTIDENTITY_BASIC
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing Application
- Threat actor
- External
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 14 weeks(95 days from discovery to filing)
- Compliance flags
- ME AG >90d · 95dME resident >60d · 94d
- Discovery-date grounding
- AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Oct 30, 2023→ Filed with AG: Feb 2, 202495d 90 days ME AG >90d Maine Discovered: Oct 30, 2023→ Notified: Feb 1, 202494d 60 days (analyst band; statutory cap is 30 days) ME resident >60d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.