HackingFinancial ServicesFinanceStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedData ExfiltratedFinancial accountIdentity (basic)Government IDHighContained

KeyBank National Association

bd_770a2169c5d0839c · schema v1 · pii pii-v1

Severity

High

Discovered

Aug 4, 2022

Filed

Aug 26, 2022

To disclose

22 days

Affected

54,295state residents only

Linked

7 filings

Confidence

68%

Full breach record for KeyBank National Association →13 incidents on file

KeyBank issued a supplemental notice to the Washington Attorney General regarding a security incident at vendor Overby-Seawell Company (OSC). An unauthorized external party gained remote access to OSC's network between July 5 and July 12, 2022, acquiring KeyBank client mortgage data. KeyBank was notified on August 4, 2022. The incident affected 54,295 Washington residents, exposing names, addresses, mortgage account numbers, and insurance info. KeyBank notified affected individuals on October 21, 2022, and offered 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Washington clock✓ WA AG ≤30d22 days discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 30 days

discovery → filing · 22 days

Jul 5, 2022

Begins

Aug 4, 2022

Discovered

Aug 26, 2022

Filed

vs. sector median

5 wks faster

This filing is one of 7 about the same incident.View merged incident

Part of Overby-Seawell Company supply-chain incident (2022) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Massachusetts State AGbd_2076dbcba57a74a12022-08-26Verified
California State AGbd_b28da354340c3c8c2022-08-26Verified
Montana State AGbd_f081eecb38503eee2022-08-26Verified
Oregon State AGbd_6ac2e700788c603b2022-08-30 · +4dVerified

Show 2 more filings ↓up to 56d gap

Oregon State AGbd_204b30c931f551152022-10-21 · +56dVerified
California State AGbd_a4f654df6f257b9b2022-10-21 · +56dVerified

Name: KeyBank National Association
norm: keybank national

Name: KeyBank National Association
norm: keybank national
Industry: Financial Servicesllm

Discovered: Aug 4, 2022
Breach occurred: Jul 5, 2022 – Jul 12, 2022
Undetected for: 30 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 21, 2022
Affected individuals: 54,295state-resident count only
Data types: Identity (basic)Financial account
Data elements: NameSocial Security number
WA-stated cause: Unauthorized Access
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found after the fact
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid AccountsT1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Regulator citations: Notified the Federal Bureau of Investigation (FBI) of this incident
Initial access: external_remote_services

During the incident: OSC is continuing to investigate this incident with the assistance of third-party cybersecurity experts
Deployed enhanced security monitoring tools across their network
Notified the Federal Bureau of Investigation (FBI) of this incident
KeyBank sent notifications to the additional impacted individuals on October 21, 2022 via U.S. mail
Established a call center to respond to individuals’ questions
Offering to provide individuals 24 months of free identity theft and credit monitoring services through Equifax
Changes made: Deployed enhanced security monitoring tools across their network
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 22 days(22 days from discovery to filing)
Compliance flags: WA AG ≤30d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 5 states

View merged incident ↗

Massachusetts State AGAug 26 · first

California State AGAug 26 · first

Montana State AGAug 26 · first

Washington State AGAug 26 · first · this page

Oregon State AG+4d

Oregon State AG+56d

California State AG+56d

Pattern: first filing Aug 26 (MA), last Oct 21 (CA) — a 56-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA14812.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 26, 2022
Raw hash: 68ad4f0af8c5e7609e1db6795c580f6a443b19d4ce2db7fc5d6283c2ef4f298d

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityKeyBank National Association

Victim entityKeyBank National Association

Incidentdiscovered Aug 4, 2022

Stated responseOSC is continuing to investigate this incident with the assistance of third-party cybersecurity experts

ComplianceWA AG ≤30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com