HackingFinancial ServicesFinanceData MishandlingSupply Chain (3P Vendor)Customer Data InvolvedGovernment IDIdentity (basic)Financial accountMediumContained

Sound Community Bank

bd_451be49806b5b730 · schema v1 · pii pii-v2

Severity

Medium

Discovered

Oct 27, 2025

Filed

Nov 19, 2025

To disclose

—

Affected

Not disclosed

Linked

3 filings

Confidence

68%

Full breach record for Sound Community Bank →3 incidents on file

Sound Community Bank notified Nebraska AG of a data breach involving a third-party advertising and mailing vendor. The incident, discovered on August 14, 2025, and reported to the Bank on October 27, 2025, exposed customers' Social Security Numbers, dates of birth, and financial account numbers. The Bank states no unauthorized activity occurred within its own systems. No specific count of affected individuals was provided.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 74 days

Aug 14, 2025

Begins

Oct 27, 2025

Discovered

Nov 19, 2025

Filed

This filing is one of 3 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Montana State AGbd_28fe4886683337c12025-11-19Candidate
Washington State AGbd_5905c198ceb631732025-11-19Verified

Name: Sound Community Bank
norm: sound community bank

Name: Sound Community Bank
norm: sound community bank
Industry: Financial Servicesllm

Discovered: Oct 27, 2025
Breach occurred: Aug 14, 2025
Undetected for: 74 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 27, 2025
Affected individuals: Not disclosed
Data types: Government IDIdentity (basic)Financial account
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain Compromise
Threat actor: Partner
Initial access: supply_chain

During the incident: Notified law enforcement
Engaged cybersecurity experts to assist in conducting a forensic review
Updated systems and procedures
Continuing to conduct a review of this vendor
Changes made: Monitor and evaluate vendors to ensure they have the same high standards
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Montana State AGNov 19 · first

Washington State AGNov 19 · first

Nebraska State AGNov 19 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://nebraska.gov/ago/data-breach/documents/bba8c0b9-c164-46c6-8c44-8fd7d935ccff.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 19, 2025
Raw hash: a42fc48b530e8bc0a7ee5bde2645ab2f6dd8044728725be060b6b881072b18fd

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entitySound Community Bank

Victim entitySound Community Bank

Incidentdiscovered Oct 27, 2025

Stated responseNotified law enforcement

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancenebraska.gov