HackingFinancial ServicesFinanceStolen CredentialsCustomer Data InvolvedTargetedIdentity (basic)Financial accountFinancialLowContained

Merrick Bank

bd_4e97035f865520a5 · schema v1 · pii pii-v1

Severity

Low

Discovered

Mar 8, 2019

Filed

Apr 12, 2019

To disclose

5 weeks

Affected

15state residents only

Linked

3 filings

Confidence

67%

All records for Merrick Bank →3 incidents on file

Account takeover notice

Merrick Bank notified cardholders of unauthorized access to their accounts. The filing says: “On March 15, 2019, we learned through our investigation that an unauthorized individual or group obtained access to the online accounts of some of our cardholders using credential information obtained elsewhere, therefore, out of an abundance of caution, we are providing you with notification, credit and identity monitoring services, and resources that you can use to protect yourself.”

Merrick Bank notified the NH AG that credential stuffing attacks on its mobile banking app affected 15 NH residents. Unauthorized access occurred using credentials obtained elsewhere. Impacted data included names, emails, account balances, credit limits, last 4 digits of card numbers, and transaction histories. Notification sent April 12, 2019.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 5 weeks / 35 days

Mar 8, 2019

Discovered

Apr 12, 2019

Filed

vs. sector median

3 wks faster

This filing is one of 3 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Montana State AGbd_818cfdd6c4552b302019-04-12Verified
Massachusetts State AGbd_e9f204dbd83c82552019-04-12Verified

Name: Merrick Bank
norm: merrick bank
Domain: merrickbank.com
Industry: Financial Services

Name: Merrick Bank
norm: merrick bank
Domain: merrickbank.com
Industry: Financial Services
Industry: Financial Servicesllm

Discovered: Mar 8, 2019
Materiality determined: —
Notification sent: Apr 12, 2019
Affected individuals: 15state-resident count only
Data types: Identity (basic)Financial accountFinancial
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General's Office
Initial access: valid_credentials

During the incident: Launched an investigation including the assistance of an independent digital forensics expert
Reported the incident to law enforcement
Notified affected New Hampshire residents via letter
Offered twelve months of complimentary credit monitoring and identity monitoring services through Kroll
Changes made: Took steps to ensure the security of the mobile banking application system
Recommended affected individuals change their password used to access the Merrick banking mobile application
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(35 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Montana State AGApr 12 · first

Massachusetts State AGApr 12 · first

New Hampshire State AGApr 12 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/merrick-bank-20190412.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 12, 2019
Raw hash: ccd979b282afff02b08a45884a4de564713dff0c87deed3598b387e0024e9299

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityMerrick Bank

Victim entityMerrick Bank

Incidentdiscovered Mar 8, 2019

Stated responseLaunched an investigation including the assistance of an independent digital forensics expert

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov