HackingFinancial ServicesFinanceStolen CredentialsCustomer Data InvolvedIdentity (basic)Financial accountCredentialsLowContained

MUFG Union Bank, National Association

bd_5d92c51a2bb560e8 · schema v1 · pii pii-v1

Severity

Low

Discovered

Nov 30, 2018

Filed

Dec 13, 2018

To disclose

13 days

Affected

1state residents only

Linked

4 filings

Confidence

66%

All records for MUFG Union Bank, National Association →2 incidents on file

Account takeover notice

MUFG Union Bank, National Association notified customers of unauthorized access to their accounts. The filing says: “There is no indication that the compromised credentials were obtained through MUB 's systems, and MUB believes the credentials likely were obtained from third-party sources.”

MUFG Union Bank, N.A. notified the New Hampshire Attorney General that an unauthorized third party used stolen customer login credentials to access online/mobile banking accounts in November 2018. One NH resident was affected. The bank reset credentials, engaged law enforcement, and provided 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 29 days

discovery → filing · 13 days

Nov 1, 2018

Begins

Nov 30, 2018

Discovered

Dec 13, 2018

Filed

vs. sector median

6 wks faster

This filing is one of 4 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_2c20dff790356fd52018-12-14 · +1dVerified
California State AGbd_2a4c92a7314b5b1b2018-12-11 · +2dVerified
Montana State AGbd_63fee85137cfc7c32018-12-07 · +6dCandidate

Name: Hunton Andrews Kurth LLP
norm: hunton andrews kurth

Name: MUFG Union Bank, National Association
norm: mufg union bank national
Industry: Financial Servicesllm

Discovered: Nov 30, 2018
Account access: Nov 1, 2018 – Nov 30, 2018
Undetected for: 29 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 7, 2018
Affected individuals: 1state-resident count only
Data types: Identity (basic)Financial accountCredentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: reported this issue to law enforcement authorities
Initial access: valid_credentials

During the incident: Began to investigate the nature and scope of the issue
Took measures to block unauthorized access to the affected Union Bank accounts
Reset the Passwords of affected individuals
Encouraged them to reset their Union Bank Online and Mobile Banking User IDs
Reported this issue to law enforcement authorities
Providing affected individuals with 12 months of credit monitoring/public records monitoring services at no cost to them
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 days(13 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Montana State AGDec 7 · first

California State AG+4d

New Hampshire State AG+6d · this page

Massachusetts State AG+7d

Pattern: first filing Dec 7 (MT), last Dec 14 (MA) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/mufg-union-bank-20181213.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 13, 2018
Raw hash: 9e5b23dda30923b918e6309b7b9a3d134c57958398a385c6f90e90eadcac7e55

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityHunton Andrews Kurth LLP

Victim entityMUFG Union Bank, National Association

Incidentdiscovered Nov 30, 2018

Stated responseBegan to investigate the nature and scope of the issue

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov