Social EngineeringFinancial ServicesFinancePhishingBECCustomer Data InvolvedGovernment IDIdentity (basic)HighResolved

Happy State Bank

bd_70e55aee5b5d69a9 · schema v1 · pii pii-v1

Severity

High

Discovered

Feb 7, 2023

Filed

Mar 16, 2023

To disclose

5 weeks

Affected · nationwide

10,0691 in this filing

Linked

5 filings

Confidence

66%

Full breach record for Happy State Bank →

Happy State Bank reported a business email compromise incident occurring July 28-29, 2022. The breach affected 10,069 individuals, including 1 Maine resident. Compromised data included names and Social Security Numbers. Notification was sent on March 16, 2023, with 12 months of credit monitoring offered.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Feb 7, 2023 → Filed with AG Mar 16, 202337d ⏱ ME AG >30d5 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 194 days

discovery → filing · 5 weeks / 37 days

Jul 28, 2022

Begins

Feb 7, 2023

Discovered

Mar 16, 2023

Filed

vs. sector median

3 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Indiana State AGbd_08a693c620b144782023-03-16Verified
Montana State AGbd_aa1b7f0ac3c73c492023-03-16Candidate
Massachusetts State AGbd_da600f3fa4024c942023-03-16Verified
Maine State AGbd_935e22ed084dd01a2023-04-27 · +42dVerified by operator

Name: Happy State Bank
norm: happy state bank
Domain: happybank.com
Industry: Financial Services

Name: Happy State Bank
norm: happy state bank
Domain: happybank.com
Industry: Financial Services
Industry: Financial Servicesllm

Discovered: Feb 7, 2023
Breach occurred: Jul 28, 2022 – Jul 29, 2022
Undetected for: 194 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 16, 2023
Affected individuals: 10,069state + nationwide
Data types: Government IDIdentity (basic)
Data elements: Social Security number
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Initial access: phishing_link

During the incident: Offered 12 months of credit monitoring and identity restoration services through Equifax
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(37 days from discovery to filing)
Compliance flags: ME AG >30d · 37d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Feb 7, 2023
→ Filed with AG: Mar 16, 2023
37d 30 days (soft) ME AG >30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Feb 7, 2023 → Filed with AG: Mar 16, 2023	37d	30 days (soft)	ME AG >30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 4 states

View merged incident ↗

Indiana State AGMar 16 · first

Montana State AGMar 16 · first

Massachusetts State AGMar 16 · first

Maine State AGMar 16 · first · this page

Maine State AG+42d

Pattern: first filing Mar 16 (IN), last Apr 27 (ME) — a 42-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/fe93a1a4-6d7c-4833-b110-bc795599b539.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 16, 2023
Raw hash: 065158e37fcecdc73edd5b1ff2f94f96ab17602af16d12d02c7f74651664888e

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityHappy State Bank

Victim entityHappy State Bank

Incidentdiscovered Feb 7, 2023

Stated responseOffered 12 months of credit monitoring and identity restoration services through Equifax

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov