HackingStolen CredentialsSupply Chain (3P Vendor)Data ExfiltratedIDENTITY_BASICIDENTITY_GOVERNMENTMediumContained
Flagstar Bank, National Association
bd_4d259a5e238333b3 · schema v1 · pii pii-v1
Full breach record for Flagstar Bank, National Association →Flagstar Bank, FSB disclosed a data breach involving its third-party file-sharing vendor, Accellion. The vulnerability was identified on January 22, 2021. Unauthorized parties accessed documents containing customer personal information, including names, Social Security numbers, and dates of birth. Flagstar took the server offline, engaged forensic experts, notified law enforcement, and offered two years of free identity monitoring via Kroll.
This filing is one of 5 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (4) · sorted by filing gap
- bd_74b910abb5f0a724Oregon State AGfiled 2021-03-15Candidate
- bd_99bd7b6b31840112Montana State AGfiled 2021-03-15Verified
- bd_9ac79c69f9794556Maine State AGfiled 2021-03-15Verified
- bd_e0acf0e4ea72fff3Washington State AGfiled 2021-03-15Verified
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-539111
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Mar 15, 2021
- Raw hash
- 87f0e830a91d04711b5d25a8f52f46ed3a4fa70cfc8075bdcb8389e80150604b
Reporting entity
- Name
- Flagstar Bank, National Associationnorm: flagstar bank national
Victim entity
- Name
- Flagstar Bank, National Associationnorm: flagstar bank national
Incident
- Discovered
- Jan 22, 2021
- Materiality determined
- —
- Notification sent
- —
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1195 Supply Chain Compromise
- Threat actor
- ExternalFinancial
- Third party
- via Accellion
- Initial access
- supply_chain
Compliance
- Time to disclose
- 7 weeks(52 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.