HackingTechnologyFinancial ServicesInformationSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Government IDPIIHighContained

Infosys McCamish Systems LLC

bd_582616b45865c38c · schema v1 · pii pii-v1

Severity

High

Discovered

Nov 3, 2023

Filed

Feb 15, 2024

To disclose

15 weeks

Affected

1,039state residents only

Linked

4 filings

Confidence

65%

Infosys McCamish Systems LLC (IMS), a third-party service provider for Bank of America's deferred compensation plans, experienced a cybersecurity event on or around November 3, 2023. An unauthorized third party accessed IMS systems. Data potentially compromised included names, addresses, emails, dates of birth, SSNs, and account information. Bank of America's systems were not compromised. IMS engaged forensic investigators and contained the threat.

J jump to incidentP pin to compareR raw source

South Carolina clock✓ SC CRA notice due15 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 15 weeks / 104 days

Nov 3, 2023

Begins

Nov 3, 2023

Discovered

Feb 15, 2024

Filed

vs. sector median

4 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Maine State AGbd_25d11105fb79a2262024-02-02 · +13dCandidate
Massachusetts State AGbd_fc022264af1151b12024-02-02 · +13dVerified
Illinois State AGbd_d5c1515acce40f302024-02-01 · +14dVerified

Name: Infosys McCamish Systems LLC
norm: infosys mccamish systems
Domain: bankofamerica.com

Name: Infosys McCamish Systems LLC
norm: infosys mccamish systems
Domain: bankofamerica.com
Industry: TechnologyllmFinancial Servicesllm

Discovered: Nov 3, 2023
Breach occurred: Nov 3, 2023
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 1,039state-resident count only
Data types: Identity (basic)Government IDPII
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External

During the incident: Retained a third-party forensic firm to investigate and assist with IMS’s recovery plan
Containing and remediating malicious activity
Rebuilding systems
Enhancing response capabilities
Changes made: Rebuilding systems
Enhancing response capabilities
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 15 weeks(104 days from discovery to filing)
Compliance flags: SC CRA notice due
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Illinois State AGFeb 1 · first

Maine State AG+1d

Massachusetts State AG+1d

South Carolina State AG+14d · this page

Pattern: first filing Feb 1 (IL), last Feb 15 (SC) — a 14-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/BankofAmericaNA.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 15, 2024
Raw hash: febe19062199c7b9f644cfc94d0e3a7768fbdfe0599b1869900563de7ae3b769

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityInfosys McCamish Systems LLC

Victim entityInfosys McCamish Systems LLC

Incidentdiscovered Nov 3, 2023

Stated responseRetained a third-party forensic firm to investigate and assist with IMS’s recovery plan

ComplianceSC CRA notice due

Extraction provenanceno artifact recorded

Source provenanceconsumer.sc.gov