HackingVulnerability ExploitSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedDelayed DiscoveryIDENTITY_BASICIDENTITY_GOVERNMENTHighContained
Northfield Bank
bd_79fd0089944d1124 · schema v1 · pii pii-v1
Full breach record for Northfield Bank →Northfield Bank reported a data breach affecting 4,112 individuals due to a security event involving the MOVEit Transfer application at a third-party vendor. The breach occurred between May 27, 2023, and May 31, 2023, and was discovered on August 8, 2023. The compromised information includes names and Social Security numbers. The bank offered affected individuals two years of credit monitoring and identity restoration services.
Maine clockDiscovered Aug 8, 2023 → Filed with AG Sep 7, 202330d ✓ ME AG ≤30d4 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 5 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (4) · sorted by filing gap
- bd_9963040c41fa4926New Hampshire State AGfiled 2023-09-08(1d gap)Verified
- bd_e04b124b7a8d579eVermont State AGfiled 2023-09-08(1d gap)Candidate
- bd_d86ff387ddb8a86aVermont State AGfiled 2023-09-25(18d gap)Verified
- bd_d9885b4724d48106New Hampshire State AGfiled 2023-10-02(25d gap)Verified
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/fec08671-932c-4f98-8ff0-a12647dc8ac2.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Sep 7, 2023
- Raw hash
- 5f540014a3ce75ee8b06b4c57491d366590f0611518071025d89fd42a253db7c
Reporting entity
- Name
- Northfield Banknorm: northfield bank
Victim entity
- Name
- Northfield Banknorm: northfield bank
Incident
- Discovered
- Aug 8, 2023
- Materiality determined
- —
- Notification sent
- Sep 7, 2023
- Affected individuals
- 4,112
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1195 Supply Chain Compromise
- Threat actor
- External
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 4 weeks(30 days from discovery to filing)
- Compliance flags
- ME AG ≤30d · 30d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Aug 8, 2023→ Filed with AG: Sep 7, 202330d 30 days ME AG ≤30d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.