HackingSupply Chain (3P Vendor)Customer Data InvolvedPIIIDENTITY_BASICIDENTITY_GOVERNMENTMediumActive
Hatch
bd_30fc3880baa08a9e · schema v1 · pii pii-v1
Full breach record for Hatch →Hatch Bank notified the NH AG of a third-party data incident involving vendor Fortra. Unauthorized access to Fortra's GoAnywhere site occurred Jan 30-31, 2023. Hatch Bank was notified Feb 3, 2023. Affected data includes names and SSNs. 581 NH residents notified. Investigation ongoing.
This filing is one of 6 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (5) · sorted by filing gap
- bd_6a0fbcf8d7c0d53aWashington State AGfiled 2023-02-28(6d gap)Candidate
- bd_7138750bbfb556dcVermont State AGfiled 2023-02-28(6d gap)Verified
- bd_9dbaa312cfff98b4California State AGfiled 2023-02-28(6d gap)Verified
- bd_dbb2e668d0b81195Oregon State AGfiled 2023-02-28(6d gap)Verified
Show 1 more filing ↓Show fewer ↑up to 6d gap
- bd_f5981ae8f8ed8013Montana State AGfiled 2023-02-28(6d gap)Verified
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/hatch-bank-20230306.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Mar 6, 2023
- Raw hash
- 62a042c496ff54b4baa9ce6d5ab28ed2617256b51ee8da528fb9e0c096514123
Reporting entity
- Name
- Hatchnorm: hatch
- Domain
- hatch.com
Victim entity
- Name
- Hatchnorm: hatch
- Domain
- hatch.com
Incident
- Discovered
- Feb 3, 2023
- Materiality determined
- Feb 7, 2023
- Notification sent
- Feb 28, 2023
- Affected individuals
- 581
- Data types
- PIIIDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1195 Supply Chain CompromiseT1041 Exfiltration Over C2 Channel
- Threat actor
- External
- Regulator citations
- Notified federal law enforcementProviding written notice to relevant state and federal regulators
- Third party
- via Fortra
- Initial access
- supply_chain
Compliance
- Time to disclose
- 4 weeks(31 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.