HackingFinancial ServicesFinanceVulnerability ExploitZero-DaySupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

PlainsCapital Bank

bd_6a16364945d087db · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 27, 2023

Filed

Jul 14, 2023

To disclose

17 days

Affected

Not disclosed

Linked

4 filings

Confidence

64%

Full breach record for PlainsCapital Bank →2 incidents on file

PlainsCapital Bank notified customers that a third-party vendor using MOVEit file transfer software was impacted by a global zero-day cyberattack between May 27 and May 31, 2023. The bank discovered the exposure on June 27, 2023. Customer data, including names, addresses, and potentially Social Security numbers and financial account information, was likely obtained by an unauthorized party. The bank is offering 12 months of credit monitoring and identity restoration services.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jun 27, 2023 → Notified Jul 14, 202317d ✓ CA 60-day OK17 days discovery → filing

Incident timeline

undetected · 31 days

discovery → filing · 17 days

May 27, 2023

Begins

Jun 27, 2023

Discovered

Jul 14, 2023

Filed

vs. sector median

6 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Montana State AGbd_d0fa7306adbe4d642023-07-14Verified
Massachusetts State AGbd_d9af88ecfff56b232023-07-14Verified
SEC 8-Kbd_651ddcbce2bbcb282023-07-03 · +11dVerified

Name: PlainsCapital Bank
norm: plainscapital bank

Name: PlainsCapital Bank
norm: plainscapital bank
Industry: Financial Servicesllm

Discovered: Jun 27, 2023
Breach occurred: May 27, 2023 – May 31, 2023
Undetected for: 31 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 14, 2023
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial account
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1190 Exploit Public-Facing Application
Threat actor: External
Third party: via MOVEit vendor
Initial access: supply_chain

During the incident: Launched an investigation to determine the scope and nature of any PlainsCapital Bank customer data that may have been impacted
Initiated a dialogue with the Vendor
Providing you with the option for complimentary access to 12 months of credit monitoring and identity restoration services provided by Cyberscout through Identity Force
Vigilantly monitor for any signs of improper use, fraud, or access to customer accounts
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 17 days(17 days from discovery to filing)
Compliance flags: CA 60-day OK · 17d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jun 27, 2023
→ Notified: Jul 14, 2023
17d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jun 27, 2023 → Notified: Jul 14, 2023	17d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 3 states

View merged incident ↗

SEC 8-KJul 3 · first

Montana State AG+11d

Massachusetts State AG+11d

California State AG+11d · this page

Pattern: first filing Jul 3, last Jul 14 (CA) — a 11-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-570311
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 14, 2023
Raw hash: d4b57a8a4d1681f70d5a5553cd80ff1fd478d20be1a385feb02077ab11df095c

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityPlainsCapital Bank

Victim entityPlainsCapital Bank

Incidentdiscovered Jun 27, 2023

Stated responseLaunched an investigation to determine the scope and nature of any PlainsCapital Bank customer data that may have been impacted

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov