HackingFinancial ServicesFinanceHacking OtherCustomer Data InvolvedIdentity (basic)Government IDHighContained

Gateway First Bank

bd_2b2a05e167a71faa · schema v1 · pii pii-v1

Severity

High

Discovered

Jan 18, 2023

Filed

Jun 1, 2023

To disclose

19 weeks

Affected · nationwide

1,7651 in this filing

Linked

3 filings

Confidence

50%

Full breach record for Gateway First Bank →2 incidents on file

Gateway First Bank, a financial services company, reported a data breach to the Maine Attorney General. The breach, which was an external system breach (hacking), occurred between March 26, 2021, and February 23, 2022, and was discovered on January 18, 2023. The breach affected one Maine resident, whose Social Security Number was compromised. Gateway First Bank offered one year of credit monitoring and identity theft protection services through Experian to the affected individual.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Jan 18, 2023 → Filed with AG Jun 1, 2023134d ✗ ME AG >90d19 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 663 days

discovery → filing · 19 weeks / 134 days

Mar 26, 2021

Begins

Jan 18, 2023

Discovered

Jun 1, 2023

Filed

vs. sector median

+11 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Montana State AGbd_a0ce5657a222bf712023-06-01Verified by operator
Massachusetts State AGbd_aa63b0a91719ee3f2023-06-01Verified

Name: Gateway First Bank
norm: gateway first bank

Name: Gateway First Bank
norm: gateway first bank
Industry: Financial Servicesllm

Discovered: Jan 18, 2023
Breach occurred: Mar 26, 2021 – Feb 23, 2022
Undetected for: 663 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 1, 2023
Affected individuals: 1,765state + nationwide
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Unauthorized Access

Changes made: Offered one year of credit monitoring and identity theft protection services through Experian.
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 19 weeks(134 days from discovery to filing)
Compliance flags: ME AG >90d · 134dME resident >60d · 134d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Jan 18, 2023
→ Filed with AG: Jun 1, 2023
134d 90 days ME AG >90d
Maine
Discovered: Jan 18, 2023
→ Notified: Jun 1, 2023
134d 60 days (analyst band; statutory cap is 30 days) ME resident >60d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Jan 18, 2023 → Filed with AG: Jun 1, 2023	134d	90 days	ME AG >90d
Maine	Discovered: Jan 18, 2023 → Notified: Jun 1, 2023	134d	60 days (analyst band; statutory cap is 30 days)	ME resident >60d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Montana State AGJun 1 · first

Massachusetts State AGJun 1 · first

Maine State AGJun 1 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/644a3ce4-0d9c-459e-a6e3-dd7ef9eec7a3.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 1, 2023
Raw hash: d3a4c61974091bf788f1186a590a6315e249435a905c0a71f40acbd81b9d906d

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityGateway First Bank

Victim entityGateway First Bank

Incidentdiscovered Jan 18, 2023

Stated responseOffered one year of credit monitoring and identity theft protection services through Experian.

ComplianceME AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov