HackingFinancial ServicesFinanceVulnerability ExploitData ExfiltratedTargetedPIIIdentity (basic)LowContained

Quorum Federal Credit Union

bd_82052e2f5c4e9a44 · schema v1 · pii pii-v1

Severity

Low

Discovered

May 31, 2023

Filed

Jul 17, 2023

To disclose

7 weeks

Affected

13state residents only

Linked

7 filings

Confidence

65%

Full breach record for Quorum Federal Credit Union →2 incidents on file

Quorum Federal Credit Union notified individuals of unauthorized access to files containing personal information via a vulnerability in MOVEit data transfer tool. Access occurred May 28-31, 2023. Quorum engaged a cybersecurity firm, offered one year of Kroll identity monitoring, and implemented additional safeguards.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 3 days

discovery → filing · 7 weeks / 47 days

May 28, 2023

Begins

May 31, 2023

Discovered

Jul 17, 2023

Filed

vs. sector median

2 wks faster

This filing is one of 7 about the same incident.View merged incident

Part of Progress Software Corporation supply-chain incident (2023) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Ransomware claims (2)

Leak Sitedispossessorbd_e8c795bcc5dc102c2023-10-18 · +93dVerified by operator
Leak Sitecl0pbd_a2debe21896a7c302023-07-05 · +12dVerified by operator

Regulatory filings (4) · sorted by filing gap

California State AGbd_b0840f575c1c318b2023-07-17Verified
Massachusetts State AGbd_c865abcecff2d4a22023-07-17Verified
Maine State AGbd_d656dc22c94733b02023-07-17Verified
Washington State AGbd_fc30fcc8f9d3ce422023-07-17Verified by operator

Name: Quorum Federal Credit Union
norm: quorum federal credit union
Domain: quorumfcu.org

Name: Quorum Federal Credit Union
norm: quorum federal credit union
Domain: quorumfcu.org
Industry: Financial Servicesllm

Discovered: May 31, 2023
Breach occurred: May 28, 2023 – May 31, 2023
Undetected for: 3 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 20, 2023
Affected individuals: 13state-resident count only
Data types: PIIIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Took the actions recommended by Progress Software, the owner of MOVEit, to resolve the issue
Commenced an investigation
A cybersecurity firm was engaged to assist
Offering you a complimentary one-year membership to identity monitoring services through Kroll
Changes made: Use the findings from the investigation to look for additional opportunities to further strengthen our cybersecurity and implement additional safeguards and security measures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(47 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

California State AGJul 17 · first

Massachusetts State AGJul 17 · first

Maine State AGJul 17 · first

Washington State AGJul 17 · first

Montana State AGJul 17 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-439.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 17, 2023
Raw hash: 386e381de37b3f4264bffe87763f27026f19c951adf65a14c2da4326f3767c84

Linked disclosures

Ransomware claims (2)

Regulatory filings (4) · sorted by filing gap

Reporting entityQuorum Federal Credit Union

Victim entityQuorum Federal Credit Union

Incidentdiscovered May 31, 2023

Stated responseTook the actions recommended by Progress Software, the owner of MOVEit, to resolve the issue

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov