HackingFinancial ServicesFinanceVulnerability ExploitStolen CredentialsSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedPIIIdentity (basic)LowContained

Enterprise Financial Group, Inc.

bd_375db7cc9864f98d · schema v1 · pii pii-v1

Severity

Low

Discovered

Feb 18, 2024

Filed

Aug 14, 2024

To disclose

25 weeks

Affected

Not disclosed

Linked

5 filings

Confidence

64%

Full breach record for Enterprise Financial Group, Inc. →

Enterprise Financial Group Inc. disclosed a security incident on February 18, 2024, where an unauthorized third party accessed and copied files from its network via unknown vulnerabilities in a third-party VPN appliance. The company engaged external cybersecurity experts, contained the incident, applied patches, and replaced the VPN appliance. Personal information, including identity data, was involved. Credit monitoring services were offered to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 25 weeks / 178 days

Feb 18, 2024

Begins

Feb 18, 2024

Discovered

Aug 14, 2024

Filed

vs. sector median

+17 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Indiana State AGbd_40a3832a6618a1c12024-08-14Candidate
Maine State AGbd_e651d689fdb81d5b2024-08-14Verified
Massachusetts State AGbd_3dd0c12fb45c94b52024-08-15 · +1dVerified
Illinois State AGbd_f6da38575127821f2024-08-01 · +13dVerified

Name: Enterprise Financial Group, Inc.
norm: enterprise financial

Name: Enterprise Financial Group, Inc.
norm: enterprise financial
Industry: Financial Servicesllm

Discovered: Feb 18, 2024
Breach occurred: Feb 18, 2024
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PIIIdentity (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: External
Third party: via Third-party VPN provider
Initial access: supply_chain

During the incident: Implemented incident response protocol
Worked with external cybersecurity experts to investigate, contain, and eradicate the incident
Applied patch provided by the third-party VPN provider
Enhanced security measures to help protect the privacy of information stored on our systems
Fully replaced the third-party VPN appliance
Arranged for comprehensive credit monitoring and identity protection services through Equifax
Changes made: Implemented all available patches
Continued to work closely with the third-party provider to mitigate any future risks
Enhanced security measures to help protect the privacy of information stored on our systems
Fully replaced the third-party VPN appliance as a precaution
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 25 weeks(178 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Illinois State AGAug 1 · first

Indiana State AG+13d

Maine State AG+13d

New Hampshire State AG+13d · this page

Massachusetts State AG+14d

Pattern: first filing Aug 1 (IL), last Aug 15 (MA) — a 14-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/enterprise-financial-group-20240814.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 14, 2024
Raw hash: df83b8e97929f91bde82b04e12b27ef3763ff39e4742a234b2e2c3769de1f95b

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityEnterprise Financial Group, Inc.

Victim entityEnterprise Financial Group, Inc.

Incidentdiscovered Feb 18, 2024

Stated responseImplemented incident response protocol

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov