DisclosureLens
HackingFinancial ServicesFinanceVulnerability ExploitZero-DayData ExfiltratedSupply Chain (3P Vendor)Customer Data InvolvedGovernment IDIdentity (basic)HighContained

Arvest Bank

bd_74c4d616e0098e3f · schema v1 · pii pii-v1

Severity

High

Discovered

Oct 13, 2023

Filed

Feb 1, 2024

To disclose

16 weeks

Affected · nationwide

26,3881 in this filing

Confidence

66%
Full breach record for Arvest Bank →4 incidents on file

Arvest Bank reported a cybersecurity incident involving its third-party vendor, Fiserv. Between May 27 and May 31, 2023, a zero-day SQL injection vulnerability in Fiserv's MOVEit Transfer tool was exploited, resulting in the exfiltration of customer data. The breach was discovered on October 13, 2023. A total of 26,388 individuals were affected, including one Maine resident. Arvest Bank notified affected individuals on January 30, 2024, and provided two years of identity theft protection services.

Maine clockDiscovered Oct 13, 2023 → Filed with AG Feb 1, 2024111d ✗ ME AG >90d16 weeks discovery → filing
⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 139 days
discovery → filing · 16 weeks / 111 days

May 27, 2023

Begins

Oct 13, 2023

Discovered

Feb 1, 2024

Filed

vs. sector median

+7 wks slower

Part of FISERV, INC. supply-chain incident (2023) — a supply-chain cascade affecting multiple organizations.View cascade →
Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed26,388 affectedView incident

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.