HackingVulnerability ExploitZero-DayData ExfiltratedSupply Chain (3P Vendor)IDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTMediumContained
Cadence Bank
bd_29237302c92f6eef · schema v1 · pii pii-v1
Full breach record for Cadence Bank →Cadence Bank notified Vermont residents of a data breach involving the MOVEit Transfer application. An unauthorized third party exploited a zero-day vulnerability in Progress Software's MOVEit between May 28-31, 2023, to access and download personal information including names, SSNs, driver's licenses, and financial account data. Cadence engaged forensic investigators, reported to law enforcement, and offered credit monitoring services.
Vermont clock✗ VT AG >45 bday25 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 2 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (1) · sorted by filing gap
- bd_972d0b95bc92e6faCalifornia State AGfiled 2023-11-22Candidate
Source provenance
- Source URL
- https://ago.vermont.gov/document/2023-11-22-cadence-bank-progress-software-moveit-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Nov 22, 2023
- Raw hash
- e7c259e480d41ac9149465916d3d9e17ba513433ac9fcd3833f8a2042e16197a
Reporting entity
- Name
- Cadence Banknorm: cadence bank
Victim entity
- Name
- Cadence Banknorm: cadence bank
Incident
- Discovered
- Jun 1, 2023
- Materiality determined
- —
- Notification sent
- Nov 22, 2023
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNT
- Attack vector
- Misconfiguration
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1486 Data Encrypted for Impact
- Threat actor
- ExternalFinancial
- Regulator citations
- reported the matter to law enforcement
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 25 weeks(174 days from discovery to filing)
- Compliance flags
- VT AG >45 bday
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.