HackingFinancial ServicesFinanceStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Financial accountLowContained

The Middlefield Banking Company

bd_2dee8d0f47f231bc · schema v1 · pii pii-v1

Severity

Low

Discovered

Apr 12, 2023

Filed

Dec 21, 2023

To disclose

36 weeks

Affected

Not disclosed

Linked

6 filings

Confidence

66%

Full breach record for The Middlefield Banking Company →2 incidents on file

The Middlefield Banking Company experienced a data security incident on or about April 12, 2023. An unauthorized actor accessed systems and acquired files containing names and account numbers of employees and customers between April 11-12, 2023. The bank notified affected individuals on December 21, 2023, offering 12 months of credit monitoring. Federal law enforcement was notified.

J jump to incidentP pin to compareR raw source

Vermont clock✗ VT AG >45 bday36 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 1 days

discovery → filing · 36 weeks / 253 days

Apr 11, 2023

Begins

Apr 12, 2023

Discovered

Nov 21, 2023

Scope determined

Dec 21, 2023

Filed

vs. sector median

+28 wks slower

This filing is one of 6 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Montana State AGbd_4752d46a27914d1a2023-12-21Candidate
New Hampshire State AGbd_719ea19c8e0056802023-12-21Verified
Massachusetts State AGbd_c1b3763023b7f8a72023-12-21Verified
California State AGbd_cc811a129570fcd52023-12-21Verified

Show 1 more filing ↓

SEC 8-Kbd_d3345e13b9cb6e072023-12-21Verified

Name: The Middlefield Banking Company
norm: the middlefield banking

Name: The Middlefield Banking Company
norm: the middlefield banking
Industry: Financial Servicesllm

Discovered: Apr 12, 2023
Breach occurred: Apr 11, 2023 – Apr 12, 2023
Undetected for: 1 dayoccurrence → discovery
Materiality determined: Nov 21, 2023
Notification sent: Dec 21, 2023
Affected individuals: Not disclosed
Data types: Identity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: prompt and continued correspondence with federal law enforcement authorities
Initial access: valid_credentials

During the incident: Launched an investigation with the assistance of outside specialists
Conducted a thorough review of the data that was potentially viewed or acquired
Undertook efforts to locate address information for the affected individuals
Put resources in place to assist
Provided prompt and continued correspondence with federal law enforcement authorities
Provided 12 months of complimentary access to credit monitoring and identity restoration services
Changes made: Reviewed existing policies and procedures relating to data protection and security
Implemented enhanced security controls
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 36 weeks(253 days from discovery to filing)
Compliance flags: VT AG >45 bday
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 5 states

View merged incident ↗

Montana State AGDec 21 · first

New Hampshire State AGDec 21 · first

Massachusetts State AGDec 21 · first

California State AGDec 21 · first

SEC 8-KDec 21 · first

Vermont State AGDec 21 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2023-12-21-middlefield-banking-company-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 21, 2023
Raw hash: 07bec2c0e14052183e9c1afdc958b078b02febb3f8b6b3938e355cf8e5885317

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityThe Middlefield Banking Company

Victim entityThe Middlefield Banking Company

Incidentdiscovered Apr 12, 2023

Stated responseLaunched an investigation with the assistance of outside specialists

ComplianceVT AG >45 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov