MalwareFinancial ServicesFinanceRansomwareSupply Chain (3P Vendor)Data ExfiltratedTargetedGovernment IDIdentity (basic)Financial accountHighContained

Sound Community Bank

bd_5905c198ceb63173 · schema v1 · pii pii-v1

Severity

High

Discovered

Oct 27, 2025

Filed

Nov 19, 2025

To disclose

23 days

Affected

5,503state residents only

Linked

3 filings

Confidence

69%

Full breach record for Sound Community Bank →3 incidents on file

Sound Community Bank notified Washington AG of a third-party vendor breach. The vendor, used for advertising and mailing, experienced a ransomware incident on Aug 14, 2025. Sensitive data including SSNs, DOBs, and financial account numbers were accessed. Bank notified on Oct 27, 2025. 5,503 Washington residents affected.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 74 days

discovery → filing · 23 days

Aug 14, 2025

Begins

Oct 27, 2025

Discovered

Nov 19, 2025

Filed

vs. sector median

5 wks faster

This filing is one of 3 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Montana State AGbd_28fe4886683337c12025-11-19Candidate
Nebraska State AGbd_451be49806b5b7302025-11-19Verified

Name: Sound Community Bank
norm: sound community bank

Name: Sound Community Bank
norm: sound community bank
Industry: Financial Servicesllm

Discovered: Oct 27, 2025
Breach occurred: Aug 14, 2025
Undetected for: 74 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 5,503state-resident count only
Data types: Government IDIdentity (basic)Financial account
Data elements: NameSocial Security numberFinancial account numberDate of birth
WA-stated cause: Cyberattack
WA-stated duration: lifecycle Unknowndexposure Unknownd
WA-stated discovery: Found while ongoingContained same day
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified law enforcement
Initial access: supply_chain

During the incident: Engaged cybersecurity experts to assist in conducting a forensic review
Updated systems and procedures
Notified law enforcement
Conducting a review of the vendor
Changes made: Monitor and evaluate vendors and their security practices
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 23 days(23 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Montana State AGNov 19 · first

Nebraska State AGNov 19 · first

Washington State AGNov 19 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA35593.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 19, 2025
Raw hash: 4b97763f2688281480395d61a0fa1003ac405a12a701be9a003980ae9784a55f

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entitySound Community Bank

Victim entitySound Community Bank

Incidentdiscovered Oct 27, 2025

Stated responseEngaged cybersecurity experts to assist in conducting a forensic review

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com