HackingFinancial ServicesFinanceVulnerability ExploitSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDMediumContained

Cambridge Trust Company

bd_767592513016515a · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 25, 2023

Filed

Aug 15, 2023

To disclose

21 days

Affected

Confidence

66%

Full breach record for Cambridge Trust Company →9 incidents on file

Cambridge Trust Company notified the NH AG of a breach involving its vendor's use of MOVEit Transfer. An unauthorized party exploited a configuration issue on May 30, 2023, accessing files containing personal info of 24 individuals (9 NH residents). Cambridge Trust notified residents on Aug 11, 2023, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 56 days

discovery → filing · 21 days

May 30, 2023

Begins

Jul 25, 2023

Discovered

Aug 15, 2023

Filed

vs. sector median

5 wks faster

Part of Progress Software Corporation supply-chain incident (2023) — a supply-chain cascade affecting multiple organizations.View cascade →

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed24 affectedView incident

Name: Cambridge Trust Company
norm: cambridge trust

Name: Cambridge Trust Company
norm: cambridge trust
Industry: Financial Servicesllm

Discovered: Jul 25, 2023
Breach occurred: May 30, 2023
Undetected for: 56 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 11, 2023
Affected individuals: 24state + nationwide
Data types: Identity (basic)Government ID
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General Consumer Protection & Antitrust Bureau
Initial access: exploit_public_facing

During the incident: Launched a comprehensive investigation into the matter
Implemented patches to MOVEit recommended by Progress
Identified the impacted files
Began notifying known affected New Hampshire residents via first class mail
Offered affected New Hampshire residents of complementary IdentityWorks credit monitoring, identity restoration, and fraud detection services, through Experian
Changes made: Implemented patches to MOVEit recommended by Progress
Offered complimentary credit monitoring services from Experian
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 21 days(21 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/cambridge-trust-20230815.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 15, 2023
Raw hash: 844dfafcd562ecf8008d3e947d930736494e6a98f13c1f8e3f3806b3b8ffcd92

Reporting entityCambridge Trust Company

Victim entityCambridge Trust Company

Incidentdiscovered Jul 25, 2023

Stated responseLaunched a comprehensive investigation into the matter

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov