HackingFinancial ServicesFinanceStolen CredentialsTargetedPIIIdentity (basic)LowContained

Members Trust Company

bd_765041258a289274 · schema v1 · pii pii-v1

Severity

Low

Discovered

Oct 16, 2023

Filed

Nov 19, 2024

To disclose

13 months

Affected

8state residents only

Linked

3 filings

Confidence

66%

Full breach record for Members Trust Company →

Members Trust Company notified Montana and other state residents that an unauthorized third party accessed employee email accounts between September 1 and October 17, 2023. The company discovered the breach on October 16, 2023, engaged forensic investigators, and is offering one year of credit monitoring. Personal information, including names, was potentially accessed.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 45 days

discovery → filing · 13 months / 400 days

Sep 1, 2023

Begins

Oct 16, 2023

Discovered

Nov 19, 2024

Filed

vs. sector median

+48 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_a37e974ec66f53ad2024-11-19Verified
Maine State AGbd_d078623a43760ff32024-11-19Verified by operator

Name: Members Trust Company
norm: members trust

Name: Members Trust Company
norm: members trust
Industry: Financial Servicesllm

Discovered: Oct 16, 2023
Breach occurred: Sep 1, 2023 – Oct 17, 2023
Undetected for: 45 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 8state-resident count only
Data types: PIIIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Initial access: valid_credentials

During the incident: Secured the email accounts from further unauthorized access
Began an internal investigation
Engaged a forensic security firm to further investigate and confirm the security of our email and computer systems
Offering a complimentary one-year membership of Experian IdentityWorksSM Credit 3B
Changes made: Enhancing our technical security measures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 months(400 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGNov 19 · first

Maine State AGNov 19 · first

Montana State AGNov 19 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/2025/02/Consumer-Notification-7.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 19, 2024
Raw hash: b95a576cdc0e7a423c9b3335c0e922c1cd39cf983d9b03f5f98bc945a26bb78f

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityMembers Trust Company

Victim entityMembers Trust Company

Incidentdiscovered Oct 16, 2023

Stated responseSecured the email accounts from further unauthorized access

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov