FEDERALItem 8.01 · voluntaryHackingFinancial ServicesFinanceVulnerability ExploitSupply Chain (3P Vendor)Customer Data InvolvedPIIHigh

1ST SOURCE CORP

bd_62968e3a67107e17 · schema v1 · pii pii-v1

Severity

High

Discovered

—

Filed

Jul 24, 2023

To disclose

—

Affected

450,000

Linked

2 records

Confidence

68%

Full breach record for 1ST SOURCE CORP →2 incidents on file

1st Source Corporation disclosed a supplemental update regarding a cybersecurity event involving the MOVEit software application. An unauthorized third-party gained access to sensitive data of commercial and individual clients, including personally identifiable information. The total estimated number of impacted records is 450,000. The company has notified state attorneys general and is offering complimentary monitoring and identity restoration services to affected clients.

J jump to incidentP pin to compareR raw source

Incident timeline — partial

? — ?

Breach window unknown

Jul 24, 2023

Filed

No interval is drawn: no breach start or discovery date is on record for this filing.

This filing is one of 2 records about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitecl0pbd_aed3fc236868314f2023-06-14 · +40dCandidate

Name: 1ST SOURCE CORP
norm: 1st source
SEC CIK: 0000034782
Domain: 1stsource.com

Name: 1ST SOURCE CORP
norm: 1st source
SEC CIK: 0000034782
Domain: 1stsource.com
Industry: Financial Servicesllm

Discovered: —
Materiality determined: —
Notification sent: —
Affected individuals: 450,000nationwide
Data types: PII
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain Compromise
Threat actor: External
Regulator citations: Notified states attorney generals or other designated state officials as required under state data security notification laws
Initial access: supply_chain

During the incident: Eliminated the software vulnerability
Notified states attorney generals or other designated state officials
Offered clients impacted complimentary monitoring, identity restoration, and fraud detection services
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filing

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statementThis record

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.sec.gov/Archives/edgar/data/34782/000003478223000114/
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Jul 24, 2023
Raw hash: d3bc1a8f5db6db145fede786317620b2fc74770f0549c5fac82cccb9a5ebaa15

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html23.0 KB

Download View at source

Linked disclosures

Ransomware claims (1)

Reporting entity1ST SOURCE CORP

Victim entity1ST SOURCE CORP

IncidentThird-Party / Supply Chain

Stated responseEliminated the software vulnerability

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancewww.sec.gov

Source filing