HackingFinancial ServicesFinanceStolen CredentialsCustomer Data InvolvedFinancial accountGovernment IDMediumContained

Comenity Capital Bank

bd_6864ff4c1631a383 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

May 22, 2023

To disclose

—

Affected

17state residents only

Linked

4 filings

Confidence

67%

Comenity Capital Bank notified Montana residents that their AAA Brand Credit Card accounts were compromised. Unauthorized actors used account numbers, ZIP codes, and the last four digits of SSNs to access the online Account Center portal and redeem Cash Back rewards. The bank blocked access, issued new cards, and offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline — partial

? — ?

Breach window unknown

May 22, 2023

Filed

—

Corroborated · see linked filings

Compliance clocks stay unassessable until a regulatory filing lands. Dashed segments fill in automatically when corroboration arrives.

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Maine State AGbd_3c359a961b62efe02023-05-22Candidate
California State AGbd_a02d2cbeec1fb4f02023-05-22Verified
Massachusetts State AGbd_216cbd80719d97b52023-05-23 · +1dVerified

Name: Bread Financial Payments, Inc.
norm: bread financial payments

Name: Comenity Capital Bank
norm: comenity capital bank
Industry: Financial Servicesllm

Discovered: —
Materiality determined: —
Notification sent: May 26, 2023
Affected individuals: 17state-resident count only
Data types: Financial accountGovernment ID
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Initial access: valid_credentials

During the incident: Blocked online access to Account Center
Closed or will close your [Brand Credit Card] card, and sent or will send you a replacement
Offering you complimentary credit monitoring and identity protection services for 12 months through Experian IdentityWorks
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Maine State AGMay 22 · first

California State AGMay 22 · first

Montana State AGMay 22 · first · this page

Massachusetts State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-301.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 22, 2023
Raw hash: eda5f2b3c057c9dd36a50fa1fa55133f8d750f5796c17cbd64903c209437e25d

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityBread Financial Payments, Inc.

Victim entityComenity Capital Bank

IncidentUnauthorized Access

Stated responseBlocked online access to Account Center

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov