HackingFinancial ServicesFinanceStolen CredentialsTargetedIdentity (basic)Government IDMediumContained

Farmers Bank & Trust

bd_742246a7642022e8 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 17, 2025

Filed

Mar 17, 2025

To disclose

28 days

Affected

1state residents only

Linked

6 filings

Confidence

66%

Full breach record for Farmers Bank & Trust →

Farmers Bank & Trust notified the Maryland AG that an unauthorized individual accessed an employee email account on Oct 25, 2024. The incident affected one Maryland resident, exposing first/last name and SSN. The bank engaged forensic investigators and offers credit monitoring.

J jump to incidentP pin to compareR raw source

Date basis clock✓ Clock withheld · confirmation date28 days discovery → filing

Incident timeline

undetected · 115 days

discovery → filing · 28 days

Oct 25, 2024

Begins

Feb 17, 2025

Discovered

Mar 17, 2025

Filed

vs. sector median

4 wks faster

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Nebraska State AGbd_12c9fe98a37f33fb2025-03-17Verified
Montana State AGbd_1703ed2428dc12822025-03-17Candidate
Indiana State AGbd_6708261fdd720f892025-03-17Verified
Massachusetts State AGbd_9c6d0ea4e01135182025-03-17Verified

Show 1 more filing ↓up to 7d gap

New Hampshire State AGbd_38f0fa9d37fc3ed82025-03-24 · +7dVerified

Name: Farmers Bank & Trust
norm: farmers bank

Name: Farmers Bank & Trust
norm: farmers bank
Industry: Financial Servicesllm

Discovered: Feb 17, 2025
Breach occurred: Oct 25, 2024
Undetected for: 115 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 17, 2025
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified Office of the Maryland Attorney General
Initial access: valid_credentials

During the incident: Launched an investigation in consultation with outside cybersecurity professionals
Conducted an extensive forensic investigation and manual review
Offering the potentially affected resident whose Social Security number was potentially impacted by the incident with complimentary credit monitoring services
Changes made: Continually evaluates and modifies its practices to enhance the security and privacy of the personal information it maintains
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 28 days(28 days from discovery to filing)
Compliance flags: Clock withheld · confirmation date

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Nebraska State AGMar 17 · first

Montana State AGMar 17 · first

Indiana State AGMar 17 · first

Massachusetts State AGMar 17 · first

Maryland State AGMar 17 · first · this page

New Hampshire State AG+7d

Pattern: first filing Mar 17 (NE), last Mar 24 (NH) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.maryland.gov/resources-info/SBN%20Documents/2025/ITU-376562.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 17, 2025
Raw hash: 53975e8ce165b5d2d0f1f7feefd51cf22150d7748efe615f10b39d34164904ef

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityFarmers Bank & Trust

Victim entityFarmers Bank & Trust

Incidentdiscovered Feb 17, 2025

Stated responseLaunched an investigation in consultation with outside cybersecurity professionals

ComplianceClock withheld · confirmation date

Extraction provenanceno artifact recorded

Source provenanceoag.maryland.gov