Social EngineeringFinancial ServicesFinancePhishingStolen CredentialsCustomer Data InvolvedTargetedIdentity (basic)Government IDFinancial accountMediumContained

Eagle Bank

bd_44f0f9aa93d5b4f3 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 20, 2022

Filed

Nov 7, 2022

To disclose

7 weeks

Affected

5state residents only

Linked

3 filings

Confidence

66%

Full breach record for Eagle Bank →164 incidents on file

Eagle Bank notified the New Hampshire Attorney General of a data breach affecting 5 NH residents. On July 30, 2022, an employee email account was compromised via a phishing email sent on September 20, 2022. The attacker accessed files containing SSNs, driver's license numbers, financial account numbers, and dates of birth. Eagle Bank engaged forensic experts, notified law enforcement, and offered two years of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 52 days

discovery → filing · 7 weeks / 48 days

Jul 30, 2022

Begins

Sep 20, 2022

Discovered

Nov 7, 2022

Filed

vs. sector median

2 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_197bea341922d3502022-11-08 · +1dVerified
Maine State AGbd_5675ceaf3f5ef5b32022-11-08 · +1dCandidate

Name: Eagle Bank
norm: eagle bank

Name: Eagle Bank
norm: eagle bank
Industry: Financial Servicesllm

Discovered: Sep 20, 2022
Breach occurred: Jul 30, 2022
Undetected for: 52 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 8, 2022
Affected individuals: 5state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security numberDate of birth
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: Notified Office of the Attorney General, Consumer Protection and Antitrust Bureau
Initial access: phishing_link

During the incident: Engaged outside forensics expert to assist with investigation
Engaged additional outside experts to review contents of the account
Notified law enforcement of the incident
Monitoring the accounts of all affected Eagle Bank customers for unusual activity
Offered two years of credit monitoring to any of the affected individuals
Changes made: Improved its security policies and procedures
Retrained its personnel
Implemented additional security measures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(48 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

New Hampshire State AGNov 7 · first · this page

Massachusetts State AG+1d

Maine State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/eagle-bank-20221107.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 7, 2022
Raw hash: 28fdc4182461e864c4a54a76610a390c398d1faf1d5308fcd2772991a446065f

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityEagle Bank

Victim entityEagle Bank

Incidentdiscovered Sep 20, 2022

Stated responseEngaged outside forensics expert to assist with investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov