HackingFinancial ServicesFinanceVulnerability ExploitSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountCVE-2023-34362MediumContained

Glacier Bank

bd_3c3d1338ddf16608 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Aug 15, 2023

To disclose

—

Affected

21state residents only

Linked

2 filings

Confidence

66%

Glacier Bank notified Montana residents of a data breach involving third-party vendor Darling Consulting Group. An unauthorized party exploited a vulnerability in Progress Software's MOVEit Transfer tool to access files containing customer PII, including names, SSNs, and account numbers. Glacier Bank systems were not directly accessed. The bank is offering one year of Experian IdentityWorks credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline — partial

? — ?

Breach window unknown

Aug 15, 2023

Filed

No interval is drawn: no breach start or discovery date is on record for this filing.

This filing is one of 2 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Maine State AGbd_0f077556865e20062023-08-15Candidate

Name: Glacier Bancorp, Inc.
norm: glacier bancorp
Domain: glacierbancorp.com

Name: Glacier Bank
norm: glacier bank
Domain: glacierbancorp.com
Industry: Financial Servicesllm

Discovered: —
Materiality determined: —
Notification sent: Aug 14, 2023
Affected individuals: 21state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security number
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Third party: via Darling Consulting Group
Initial access: exploit_public_facing
CVE references: CVE-2023-34362

During the incident: Working with DCG to investigate this incident
Identifying what information may have been involved
Exploring steps to help prevent a similar incident from occurring in the future
Reviewing vendor relationships
Notifying affected individuals
Offering a complimentary one-year membership of Experian IdentityWorks Credit 3B
Changes made: Reviewing vendor relationships
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Maine State AGAug 15 · first

Montana State AGAug 15 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-557.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 15, 2023
Raw hash: 599ecb356a07e840c87636cccaf00c6ea9634a7502bccb760e501e9d1d1f5cd2

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityGlacier Bancorp, Inc.

Victim entityGlacier Bank

IncidentThird-Party / Supply Chain

Stated responseWorking with DCG to investigate this incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov