HackingFinancial ServicesFinanceVulnerability ExploitSupply Chain (3P Vendor)Data ExfiltratedIdentity (basic)Government IDFinancial accountMediumContained

The Bank of Canton

bd_456ec0a1d3fd0519 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 22, 2023

Filed

Oct 20, 2023

To disclose

28 days

Affected

Not disclosed

Linked

5 filings

Confidence

66%

Full breach record for The Bank of Canton →9 incidents on file

Bank of Canton notified Vermont AG of a data breach involving its third-party provider's MOVEit Managed File Transfer application. The incident, occurring around May 27, 2023, exposed customer deposit account names, account numbers, and Social Security numbers. Bank of Canton determined sufficient information to notify customers by September 22, 2023, and offered 24 months of identity monitoring.

J jump to incidentP pin to compareR raw source

Vermont clock⏱ VT AG >14 bday28 days discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 118 days

discovery → filing · 28 days

May 27, 2023

Begins

Sep 22, 2023

Discovered

Oct 20, 2023

Filed

vs. sector median

4 wks faster

This filing is one of 5 about the same incident.View merged incident

Part of Progress Software Corporation supply-chain incident (2023) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Indiana State AGbd_8afdf5141accef662023-10-20Verified
New Hampshire State AGbd_4442f0b0462eac942023-10-23 · +3dVerified
Maine State AGbd_7f4530eae54bd2022023-10-23 · +3dCandidate
Massachusetts State AGbd_8a6bc6c38666d5742023-10-23 · +3dVerified

Name: The Bank of Canton
norm: the bank of canton

Name: The Bank of Canton
norm: the bank of canton
Industry: Financial Servicesllm

Discovered: Sep 22, 2023
Breach occurred: May 27, 2023
Undetected for: 118 daysoccurrence → discovery
Materiality determined: Sep 22, 2023
Notification sent: Oct 20, 2023
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security number
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Regulator citations: Filed notice with the Office of the Vermont Attorney General
Third party: via Progress Software (MOVEit Provider)
Initial access: exploit_public_facing

During the incident: Initiated communications with the Provider to understand the scope and impact
Conducted comprehensive and detailed review to determine the nature of data impacted
Offered complimentary access to twenty-four (24) months of identity monitoring provided through Kroll
Continued customary monitoring for unusual activity through automated fraud detection and analytical tools
Changes made: Provider patched the technical vulnerabilities related to the MOVEit software
Provider remediated this event in accordance with the MOVEit software provider’s guidelines
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 28 days(28 days from discovery to filing)
Compliance flags: VT AG >14 bday
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Indiana State AGOct 20 · first

Vermont State AGOct 20 · first · this page

New Hampshire State AG+3d

Maine State AG+3d

Massachusetts State AG+3d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2023-10-20-bank-canton-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 20, 2023
Raw hash: e69db5bea66d9342b4e333df7a47b7477b6adb05fcc3f3ce2cb57e379a56b950

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityThe Bank of Canton

Victim entityThe Bank of Canton

Incidentdiscovered Sep 22, 2023

Stated responseInitiated communications with the Provider to understand the scope and impact

ComplianceVT AG >14 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov