FEDERALItem 8.01 · voluntaryHackingFinancial ServicesFinanceVulnerability ExploitSupply Chain (3P Vendor)Customer Data InvolvedPIILowContained

1ST SOURCE CORP

bd_66ec9f2d6644e603 · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Jul 10, 2023

To disclose

—

Affected

Not disclosed

Linked

10 filings

Confidence

67%

Full breach record for 1ST SOURCE CORP →2 incidents on file

1st Source Corporation disclosed that an unauthorized third party gained access to sensitive client data via a previously unknown vulnerability in Progress Software's MOVEit file transfer software. The incident affected commercial and individual clients, exposing personally identifiable information. The company patched the software, hardened servers, engaged forensic experts, and notified authorities. Investigation is ongoing; no material adverse effect is currently expected.

J jump to incidentP pin to compareR raw source

Incident timeline — partial

? — ?

Breach window unknown

Jul 10, 2023

Filed

—

Corroborated · see linked filings

Compliance clocks stay unassessable until a regulatory filing lands. Dashed segments fill in automatically when corroboration arrives.

This filing is one of 10 about the same incident.View merged incident

Part of Progress Software Corporation supply-chain incident (2023) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (9) · sorted by filing gap

Vermont State AGbd_a872f10fb82b1c592023-07-14 · +4dCandidate
California State AGbd_504a71c703e7184f2023-07-19 · +9dVerified
Montana State AGbd_644846888cf47c7f2023-07-19 · +9dVerified
Maine State AGbd_ee5f8afdf477969e2023-07-19 · +9dVerified

Show 5 more filings ↓up to 17d gap

Washington State AGbd_d0cebba25691bccf2023-07-20 · +10dVerified
Oregon State AGbd_db8e5883d0d70d122023-07-20 · +10dVerified
California State AGbd_4a59c8811709f62b2023-07-26 · +16dVerified
New Hampshire State AGbd_fda2be588d0437762023-07-26 · +16dVerified
Oregon State AGbd_08c27ccfede4e9ef2023-07-27 · +17dVerified

Name: 1ST SOURCE CORP
norm: 1st source
SEC CIK: 0000034782
Domain: 1stsource.com

Name: 1ST SOURCE CORP
norm: 1st source
Domain: 1stsource.com
Industry: Financial Servicesllm

Discovered: —
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PII
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: Contacting law enforcement and regulatory authorities
Initial access: exploit_public_facing

During the incident: Patching the software according to the Vendor's published protocols
Hardening of the host server containing the MOVEit software
Launching an internal investigation in partnership with outside independent cybersecurity forensic experts
Contacting law enforcement and regulatory authorities
Notifying and working with impacted commercial clients
Identifying and directly notifying individual clients who have been impacted
Offering complimentary credit monitoring and identity restoration services
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 10 filings · 7 states

View merged incident ↗

SEC 8-KJul 10 · first · this page

Vermont State AG+4d

California State AG+9d

Montana State AG+9d

Maine State AG+9d

Washington State AG+10d

Oregon State AG+10d

California State AG+16d

New Hampshire State AG+16d

Oregon State AG+17d

Pattern: first filing Jul 10, last Jul 27 (OR) — a 17-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filing

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statementThis record

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.sec.gov/Archives/edgar/data/34782/000003478223000104/
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Jul 10, 2023
Raw hash: 3f0909daa3d346aa28dda2b3d611c1b34be545533f72dc95a31046f7fcaf1597

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html26.5 KB

Download View at source

Linked disclosures

Regulatory filings (9) · sorted by filing gap

Reporting entity1ST SOURCE CORP

Victim entity1ST SOURCE CORP

IncidentThird-Party / Supply Chain

Stated responsePatching the software according to the Vendor's published protocols

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancewww.sec.gov

Source filing