HackingFinancial ServicesFinanceStolen CredentialsData ExfiltratedCustomer Data InvolvedDelayed DiscoveryGovernment IDIdentity (basic)Financial accountMediumContained

Frost Bank

bd_57500bb26b4174d5 · schema v1 · pii pii-v2

Severity

Medium

Discovered

Apr 16, 2026

Filed

May 19, 2026

To disclose

5 weeks

Affected

74state residents only

Linked

6 filings

Confidence

68%

Full breach record for Frost Bank →

Sefas Innovation, Inc. notified Frost Bank customers of a data security incident involving an SFTP server used for software support. Unauthorized access occurred between December 2025 and April 2026, resulting in the exfiltration of tax forms and bill pay images containing names, SSNs, and account numbers. Frost Bank was notified on April 22, 2026. Affected individuals were offered 12 months of credit monitoring. The incident is contained.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 136 days

discovery → filing · 5 weeks / 33 days

Dec 1, 2025

Begins

Apr 16, 2026

Discovered

May 19, 2026

Filed

vs. sector median

4 wks faster

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteeverestbd_5a86e8b29efb82bf2026-04-20 · +29dVerified

Regulatory filings (4) · sorted by filing gap

Texas State AGbd_5f4aac65b3dc3f392026-05-20 · +1dVerified
Massachusetts State AGbd_8b776d1a699a96f92026-05-20 · +1dVerified
Vermont State AGbd_9bc98c2af470155e2026-05-20 · +1dVerified
California State AGbd_b213ce708cd456a52026-05-20 · +1dVerified

Name: Sefas Innovation, Inc.
norm: sefas innovation

Name: Frost Bank
norm: frost bank
Domain: frostbank.com
Industry: Financial Servicesllm

Discovered: Apr 16, 2026
Breach occurred: Dec 1, 2025 – Apr 16, 2026
Undetected for: 136 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 20, 2026
Affected individuals: 74state-resident count only
Data types: Government IDIdentity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Engaged cybersecurity specialists to assist in determining the nature and scope of the incident
Prevented further unauthorized activity
Isolated the system
Provided access to Credit Monitoring/Credit Report/Credit Score services at no charge
Provided proactive fraud assistance
Changes made: Look for opportunities to enhance security on an ongoing basis
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(33 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Montana State AGMay 19 · first · this page

Texas State AG+1d

Massachusetts State AG+1d

Vermont State AG+1d

California State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/2026/09/Consumer-notification-letter-13.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 19, 2026
Raw hash: 6490fd7a3983e3c85636ae38cb2eaffa4ebf0193969ae973bd094e72a3a3ce69

Linked disclosures

Ransomware claims (1)

Regulatory filings (4) · sorted by filing gap

Reporting entitySefas Innovation, Inc.

Victim entityFrost Bank

Incidentdiscovered Apr 16, 2026

Stated responseEngaged cybersecurity specialists to assist in determining the nature and scope of the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov