HackingFinancial ServicesFinanceStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedGovernment IDIdentity (basic)Financial accountMediumActive

Sound Community Bank

bd_28fe4886683337c1 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 27, 2025

Filed

Nov 19, 2025

To disclose

23 days

Affected

11state residents only

Linked

3 filings

Confidence

66%

Full breach record for Sound Community Bank →3 incidents on file

Sound Community Bank notified Montana residents of a third-party vendor breach affecting SSNs, DOBs, and financial account numbers. The vendor, used for advertising and mailing, was compromised on August 14, 2025. The bank was notified on October 27, 2025. No unauthorized activity was found in the bank's internal systems.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 74 days

discovery → filing · 23 days

Aug 14, 2025

Begins

Oct 27, 2025

Discovered

Nov 19, 2025

Filed

vs. sector median

5 wks faster

This filing is one of 3 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Nebraska State AGbd_451be49806b5b7302025-11-19Verified
Washington State AGbd_5905c198ceb631732025-11-19Verified

Name: Sound Community Bank
norm: sound community bank

Name: Sound Community Bank
norm: sound community bank
Industry: Financial Servicesllm

Discovered: Oct 27, 2025
Breach occurred: Aug 14, 2025
Undetected for: 74 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 11state-resident count only
Data types: Government IDIdentity (basic)Financial account
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain Compromise
Threat actor: External
Initial access: supply_chain

During the incident: Notified law enforcement
Engaged cybersecurity experts to assist in conducting a forensic review
Update systems and procedures
Changes made: Monitor and evaluate vendors and their security practices
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 23 days(23 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Nebraska State AGNov 19 · first

Washington State AGNov 19 · first

Montana State AGNov 19 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/2026/01/Consumer-notification-letter-5.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 19, 2025
Raw hash: 2431e9846cf49f22179faad8766fbdcd694ce9b87d00f695187d9424db2f6251

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entitySound Community Bank

Victim entitySound Community Bank

Incidentdiscovered Oct 27, 2025

Stated responseNotified law enforcement

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov