HackingProfessional ServicesProfessional ServicesVulnerability ExploitSupply Chain (3P Vendor)Data ExfiltratedIdentity (basic)LowContained

First National Bank of Omaha

bd_535ce948f9e55970 · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Aug 10, 2023

To disclose

—

Affected

Not disclosed

Linked

5 filings

Confidence

66%

Full breach record for First National Bank of Omaha →

Pension Benefit Information, LLC (PBI) disclosed a data breach involving the MOVEit Transfer software vulnerability exploited by an unauthorized third party on May 29-30, 2023. The attacker accessed a PBI server and downloaded data containing names and other data elements. PBI patched servers, investigated, and is offering credit monitoring services. No identity theft was known at the time of filing.

J jump to incidentP pin to compareR raw source

Incident timeline

May 29, 2023

Begins

Aug 10, 2023

Filed

This filing is one of 5 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Montana State AGbd_502dc035e38d00d32023-08-10Candidate
Indiana State AGbd_9ec65596efffd97d2023-08-16 · +6dVerified
Massachusetts State AGbd_d2d7eac205f00ab62023-08-22 · +12dVerified
Maine State AGbd_119400e0bc8b56452023-08-23 · +13dVerified by operator

Name: Pension Benefit Information, LLC
norm: pension benefit information
Domain: mypensionbenefitinformation.com

Name: First National Bank of Omaha
norm: first national bank of omaha
Industry: Professional Servicesllm

Discovered: —
Breach occurred: May 29, 2023 – May 30, 2023
Materiality determined: —
Notification sent: Aug 10, 2023
Affected individuals: Not disclosed
Data types: Identity (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Patch servers
Investigate
Assess the security of our systems
Notify potentially affected customers and individuals
Reviewing and enhancing our information security policies and procedures
Offering you access to 12/24 months of complimentary credit monitoring and identity restoration services through Kroll
Changes made: Reviewing and enhancing our information security policies and procedures
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Montana State AGAug 10 · first

Vermont State AGAug 10 · first · this page

Indiana State AG+6d

Massachusetts State AG+12d

Maine State AG+13d

Pattern: first filing Aug 10 (MT), last Aug 23 (ME) — a 13-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2023-08-10-first-national-bank-omaha-pbi-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 10, 2023
Raw hash: 6eb9341fd0f1fe45330ae3d50fc4469850afeca4efef198c2f0cb2cddc588903

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityPension Benefit Information, LLC

Victim entityFirst National Bank of Omaha

IncidentThird-Party / Supply Chain

Stated responsePatch servers

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov