HackingFinancial ServicesFinanceVulnerability ExploitData ExfiltratedCustomer Data InvolvedSupply Chain (3P Vendor)Identity (basic)Financial accountLowContained

Enterprise Bank and Trust Company

bd_594a2a1f589990a5 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jun 1, 2023

Filed

Jan 22, 2024

To disclose

34 weeks

Affected

410state residents only

Linked

3 filings

Confidence

66%

Full breach record for Enterprise Bank and Trust Company →5 incidents on file

Enterprise Bank & Trust Company reported a data breach involving MOVEit Transfer software exploited by unauthorized actors between May 27-31, 2023. The incident, discovered in early June 2023, resulted in the exfiltration of personal information including names and financial account details. Approximately 410 New Hampshire residents were notified on January 22, 2024. The bank engaged Fiserv, remediated vulnerabilities, and provided credit monitoring services via Kroll.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >90d34 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 5 days

discovery → filing · 34 weeks / 235 days

May 27, 2023

Begins

Jun 1, 2023

Discovered

Jan 22, 2024

Filed

vs. sector median

+25 wks slower

This filing is one of 3 about the same incident.View merged incident

Part of FISERV, INC. supply-chain incident (2023) — a supply-chain cascade affecting multiple organizations.View cascade →

A leak claim by cl0p about this victim predates this filing by 180 days.View originating leak claim

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Vermont State AGbd_17e88d1c015691762024-01-22Candidate
Massachusetts State AGbd_af2d796fdda567a22024-01-22Verified

Name: Enterprise Bank and Trust Company
norm: enterprise bank and
Domain: enterprisebanking.com

Name: Enterprise Bank and Trust Company
norm: enterprise bank and
Domain: enterprisebanking.com
Industry: Financial Servicesllm

Discovered: Jun 1, 2023
Breach occurred: May 27, 2023 – May 31, 2023
Undetected for: 5 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 22, 2024
Affected individuals: 410state-resident count only
Data types: Identity (basic)Financial account
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: notified regulatory bodies as requiredproviding written notice of this event to relevant state regulators
Third party: via Fiserv
Initial access: exploit_public_facing

During the incident: Moved quickly to investigate and respond to the event
Assess the security of Enterprise Bank systems
Ensure notification to potentially affected individuals
Providing access to credit monitoring services for , through Kroll
Providing impacted individuals with guidance on how to better protect against identity theft and fraud
Providing written notice of this event to relevant state regulators
Remediated all technical vulnerabilities and patched systems in accordance with the MOVEit software provider’s guidelines
Mobilized a technical response team to examine the relevant MOVEit Transfer systems
Changes made: Remediated all technical vulnerabilities and patched systems in accordance with the MOVEit software provider’s guidelines
Mobilized a technical response team to examine the relevant MOVEit Transfer systems and ensure that there were no further vulnerabilities
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 34 weeks(235 days from discovery to filing)
Compliance flags: Leak >90d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Vermont State AGJan 22 · first

Massachusetts State AGJan 22 · first

New Hampshire State AGJan 22 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/enterprise-bank-trust-company-20240122.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 22, 2024
Raw hash: 44747709e20af502dac25771de89ad71e6ddd0a693a91c23cabf13b6509a7dac

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityEnterprise Bank and Trust Company

Victim entityEnterprise Bank and Trust Company

Incidentdiscovered Jun 1, 2023

Stated responseMoved quickly to investigate and respond to the event

ComplianceLeak >90d

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov