MalwareFinancial ServicesFinanceRansomwareData ExfiltratedRansom DemandedCustomer Data InvolvedTargetedIdentity (basic)Government IDFinancial accountPIIMediumContained

Goldwater Bank, N.A.

bd_622351252ee38361 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Oct 29, 2021

To disclose

—

Affected

Not disclosed

Linked

5 filings

Confidence

81%

Full breach record for Goldwater Bank, N.A. →

Goldwater Bank, N.A. was targeted by a ransomware attack on May 21, 2021. The bank's IT vendor detected and stopped the attack before ransomware encryption was completed, but attackers gained unauthorized access to customer data including names, addresses, phone numbers, Social Security numbers, account numbers, and tax identification numbers. The bank notified the FBI, investigated the incident, and arranged complimentary identity protection services through IdentityForce for affected customers.

J jump to incidentP pin to compareR raw source

Incident timeline

May 21, 2021

Begins

Oct 29, 2021

Filed

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Washington State AGbd_125ff3a001d249222021-10-29Candidate
Montana State AGbd_eb3a897d5c5088cd2021-10-29Verified
Massachusetts State AGbd_f7331b025a3d09502021-10-29Verified
Indiana State AGbd_4d62f4b45a829f6c2021-09-10 · +49dVerified

Name: Goldwater Bank, N.A.
norm: goldwater bank na

Name: Goldwater Bank, N.A.
norm: goldwater bank na
Industry: Financial Servicesllm

Discovered: —
Breach occurred: May 21, 2021
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial accountPII
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Reported the event to the Federal Bureau of Investigation

During the incident: Goldwater Bank's IT vendor received alerts of unusual network activity and was able to quickly respond and stop the unauthorized access in process and prevent further infiltration
Reported the event to the Federal Bureau of Investigation and has worked to investigate the event to determine what happened, what data was impacted, and who was responsible
Identified a location where some of the impacted data was being stored and worked quickly to secure its removal
Conducted our own internal investigation to protect and minimize any financial impact
Thoroughly evaluated our existing cybersecurity infrastructure and processes
Working with law enforcement to identify and pursue the responsible parties
Arranged for a complimentary one-year membership in an identity privacy protection service provided by IdentityForce
Changes made: Evaluated existing cybersecurity infrastructure and processes and working to strengthen safeguards to stay ahead of this type of threat activity
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Indiana State AGSep 10 · first

Washington State AG+49d

Montana State AG+49d

Massachusetts State AG+49d

California State AG+49d · this page

Pattern: first filing Sep 10 (IN), last Oct 29 (CA) — a 49-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-547024
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 29, 2021
Raw hash: 8a644384da66add927466b32b71dfd801da0768eec9fdff3526288ee441f6ff9

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityGoldwater Bank, N.A.

Victim entityGoldwater Bank, N.A.

IncidentRansomware

Stated responseGoldwater Bank's IT vendor received alerts of unusual network activity and was able to quickly respond and stop the unauthorized access in process and prevent further infiltration

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov