HackingVulnerability ExploitData ExfiltratedCustomer Data InvolvedIDENTITY_GOVERNMENTPIIHighContained
The Bank of Canton
bd_7f4530eae54bd202 · schema v1 · pii pii-v1
Full breach record for The Bank of Canton →Bank of Canton reported a data breach occurring on May 27, 2023, discovered on September 22, 2023. The incident involved the exploitation of a vulnerability on an FTP platform used by a third-party service provider. Approximately 10,070 individuals were affected, including 31 Maine residents. The breach compromised names and Social Security Numbers. The bank provided written notification and offered 24 months of identity theft protection services via Kroll, Inc.
Maine clockDiscovered Sep 22, 2023 → Filed with AG Oct 23, 202331d ⏱ ME AG >30d4 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 3 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (2) · sorted by filing gap
- bd_4442f0b0462eac94New Hampshire State AGfiled 2023-10-23Verified
- bd_456ec0a1d3fd0519Vermont State AGfiled 2023-10-20(3d gap)Verified
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/0992baae-1c54-4aa2-ab16-636f511f96ab.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Oct 23, 2023
- Raw hash
- d1f3817e31cd707791a168d1402916ee18f87aa0f5e3e52d5f4200ea3c54c7b8
Reporting entity
- Name
- GOODWIN PROCTER LLPnorm: goodwin procter
- Domain
- goodwinlaw.com
Victim entity
- Name
- The Bank of Cantonnorm: the bank of canton
Incident
- Discovered
- Sep 22, 2023
- Materiality determined
- —
- Notification sent
- Oct 20, 2023
- Affected individuals
- 10,070
- Data types
- IDENTITY_GOVERNMENTPII
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing Application
- Threat actor
- External
- Regulator citations
- Filed data breach notice with Maine Attorney General
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 4 weeks(31 days from discovery to filing)
- Compliance flags
- ME AG >30d · 31d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Sep 22, 2023→ Filed with AG: Oct 23, 202331d 30 days (soft) ME AG >30d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.