FEDERALItem 8.01 · voluntaryHackingFinancial ServicesFinanceVulnerability ExploitZero-DaySupply Chain (3P Vendor)Customer Data InvolvedDownstream VictimsLowActive

Sound Community Bank

bd_58f08c8f117da1a8 · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Jul 14, 2023

To disclose

—

Affected

Linked

3 filings

Confidence

90%

Full breach record for Sound Community Bank →3 incidents on file

Sound Financial Bancorp disclosed that its subsidiary Sound Community Bank was affected by the MOVEit Transfer zero-day vulnerability (Progress Software) via a third-party vendor providing account hosting and transaction processing. The vendor used MOVEit to transfer data on approximately 16,000 of the Bank's mobile and online banking customers. Vendor forensics indicate the data was downloaded once during a valid transfer; investigation ongoing. Law enforcement and banking regulators notified.

J jump to incidentP pin to compareR raw source

Incident timeline — partial

? — ?

Breach window unknown

Jul 14, 2023

Filed

No interval is drawn: no breach start or discovery date is on record for this filing.

This filing is one of 3 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Montana State AGCL0Pbd_778654f2c770ea952023-07-17 · +3dCandidate
Maine State AGbd_cf9ca7f029a63bda2023-07-17 · +3dCandidate

Name: Sound Financial Bancorp, Inc.
norm: sound financial bancorp
SEC CIK: 0001541119

Name: Sound Community Bank
norm: sound community bank
Industry: Financial Servicesllm

Discovered: —
Materiality determined: —
Notification sent: —
Affected individuals: 0
Data types: —
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1195 Supply Chain Compromise
Threat actor: External
Regulator citations: Notified primary banking regulators
Initial access: supply_chain

During the incident: Notified law enforcement
Notified primary banking regulators
Working diligently to notify all potentially affected customers as soon as reasonably possible
Established Client Service Center contact line for customer questions
Changes made: Vendor rectified the vulnerability that allowed the incident to occur
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 2 states

View merged incident ↗

SEC 8-KJul 14 · first · this page

Montana State AG+3d

Maine State AG+3d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filing

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statementThis record

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.sec.gov/Archives/edgar/data/1541119/000092708923000102/sfbc20230713_8k.htm
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Jul 14, 2023
Raw hash: 0f6ce9d2f2d483cde732b9cffe901d5e1f5f505deb852ac2732e990faf685194

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html28.0 KB

Download View at source

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entitySound Financial Bancorp, Inc.

Victim entitySound Community Bank

IncidentThird-Party / Supply Chain

Stated responseNotified law enforcement

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancewww.sec.gov

Source filing