HackingFinancial ServicesProfessional ServicesFinanceStolen CredentialsCustomer Data InvolvedSupply Chain (3P Vendor)Identity (basic)Government IDFinancial accountHighContained

BANK OF AMERICA CORPORATION

bd_788ac9c25fa0a2a9 · schema v1 · pii pii-v1

Severity

High

Discovered

Feb 4, 2023

Filed

Mar 24, 2023

To disclose

7 weeks

Affected

1,664state residents only

Linked

7 filings

Confidence

66%

Full breach record for BANK OF AMERICA CORPORATION →130 incidents on file

NCB Management Services, Inc. notified Hawaii residents of a data breach where an unauthorized party accessed systems on Feb 1, 2023. NCB, a third-party servicer for Bank of America, confirmed access on March 8, 2023. Data included names, SSNs, driver's licenses, and credit card details for closed accounts. NCB engaged law enforcement and offered 2 years of Experian IdentityWorks.

J jump to incidentP pin to compareR raw source

Hawaii clock✓ HI CRA notice due7 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 3 days

discovery → filing · 7 weeks / 48 days

Feb 1, 2023

Begins

Feb 4, 2023

Discovered

Mar 24, 2023

Filed

vs. sector median

2 wks faster

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Montana State AGbd_1a81aeb7e9ad48802023-03-24Candidate
Massachusetts State AGbd_9d556329b78097232023-03-24Verified
Indiana State AGbd_c02212653b5b8acb2023-03-28 · +4dVerified
South Carolina State AGbd_5872219af2b1c8862023-04-04 · +11dVerified

Show 2 more filings ↓up to 32d gap

Massachusetts State AGbd_2fdc9bd20bcc273e2023-04-11 · +18dVerified
Massachusetts State AGbd_c43244c8303f75122023-04-25 · +32dCandidate

Name: NCB Management Services, Inc.
norm: ncb management

Name: BANK OF AMERICA CORPORATION
norm: bank of america
Domain: bankofamerica.com
Industry: Financial ServicesllmProfessional Servicesllm

Discovered: Feb 4, 2023
Breach occurred: Feb 1, 2023
Undetected for: 3 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 24, 2023
Affected individuals: 1,664state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Third party: via NCB Management Services, Inc.
Initial access: valid_credentials

During the incident: NCB is working with federal law enforcement authorities
Making available a complimentary two-year membership in an identity theft protection service provided by Experian IdentityWorks
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(48 days from discovery to filing)
Compliance flags: HI CRA notice due
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 5 states

View merged incident ↗

Montana State AGMar 24 · first

Massachusetts State AGMar 24 · first

Hawaii State AGMar 24 · first · this page

Indiana State AG+4d

South Carolina State AG+11d

Massachusetts State AG+18d

Massachusetts State AG+32d

Pattern: first filing Mar 24 (MT), last Apr 25 (MA) — a 32-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://cca.hawaii.gov/wp-content/uploads/2026/05/2023-0439.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 24, 2023
Raw hash: 4516a3e41d80749157d05901b6be47150e7f3cc8aeb6c9e00623a5f89b93adb6

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityNCB Management Services, Inc.

Victim entityBANK OF AMERICA CORPORATION

Incidentdiscovered Feb 4, 2023

Stated responseNCB is working with federal law enforcement authorities

ComplianceHI CRA notice due

Extraction provenanceno artifact recorded

Source provenancecca.hawaii.gov