FEDERALHackingFinancial ServicesFinanceVulnerability ExploitSupply Chain (3P Vendor)Supply Chain (Dependency)Customer Data InvolvedDownstream VictimsN-DayPIIIdentity (basic)LowResolved

FIRST MERCHANTS CORP

bd_6e667230854a713c · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Feb 29, 2024

To disclose

—

Affected

Not disclosed

Confidence

66%

Full breach record for FIRST MERCHANTS CORP →

A bank holding company disclosed in its 2023 10-K Item 1C that customer data was potentially included in the global MOVEit Transfer (Progress Software) incident. The compromise affected a third-party financial-institution vendor, not the Bank's own network. Online/mobile banking customers' personal information may have been copied. The vendor applied Progress's recommended patches; the Bank notified affected customers. Cyber insurance is expected to cover many related costs. Described as the only cybersecurity incident that materially affected the Corporation in FY2023.

J jump to incidentP pin to compareR raw source

Incident timeline

Jan 1, 2023

Begins

Feb 29, 2024

Filed

Part of Progress Software Corporation supply-chain incident (2023) — a supply-chain cascade affecting multiple organizations.View cascade →

Tracked as a single-filing incident — the only disclosure on record for this event so far.No incident reportedView incident

Name: FIRST MERCHANTS CORP
norm: first merchants
SEC CIK: 712534

Name: FIRST MERCHANTS CORP
norm: first merchants
SEC CIK: 712534
Industry: Financial Servicesllm

Discovered: —
Breach occurred: Jan 1, 2023 – Dec 31, 2023
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PIIIdentity (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1195 Supply Chain Compromise
Threat actor: ExternalFinancial
Initial access: supply_chain

During the incident: Vendor confirmed that it implemented the recommended patches released by Progress Software Corporation for the platform
The Bank worked with the vendor to determine the potentially impacted customers and the extent of information potentially exposed
The Bank notified potentially affected customers appropriately
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filing

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statementThis record

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.sec.gov/Archives/edgar/data/712534/000071253424000071/frme-20231231.htm
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Feb 29, 2024
Raw hash: dc975d4887128ac5c9d1d44a1eed5e2123db34fa287ddd6594bac392bf4b72d9

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html5.3 MB

Download View at source

Reporting entityFIRST MERCHANTS CORP

Victim entityFIRST MERCHANTS CORP

IncidentThird-Party / Supply Chain

Stated responseVendor confirmed that it implemented the recommended patches released by Progress Software Corporation for the platform

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancewww.sec.gov

Source filing