HackingStolen CredentialsCustomer Data InvolvedIDENTITY_BASICFINANCIAL_ACCOUNTIDENTITY_GOVERNMENTMediumContained
Varo Bank, National Association
bd_8777007060b756ca · schema v1 · pii pii-v1
Full breach record for Varo Bank, National Association →Varo Bank, N.A. notified customers that an unauthorized third party used valid credentials to access a subset of customer accounts between March 12 and March 18, 2024. The incident did not involve Varo's internal network. Affected data included name, address, email, phone, bank account number, and last 4 digits of SSN. Varo blocked the activity, investigated, and offered 12 months of credit monitoring.
California clockDiscovered Mar 12, 2024 → Notified May 7, 202456d ✓ CA 60-day OK8 weeks discovery → filing
This filing is one of 4 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (3) · sorted by filing gap
- bd_036b60ed2a159b94Vermont State AGfiled 2024-05-07Verified
- bd_11e27d56c7b6753dMontana State AGfiled 2024-05-07Candidate
- bd_70cc782e61e6813bMaine State AGfiled 2024-05-07Verified
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-584955
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- May 7, 2024
- Raw hash
- dabbc9248fcbfcdafca4f0b033b533f396d7e43651513d5aa446159e2f05602c
Reporting entity
- Name
- Varo Bank, National Associationnorm: varo bank national
Victim entity
- Name
- Varo Bank, National Associationnorm: varo bank national
Incident
- Discovered
- Mar 12, 2024
- Materiality determined
- —
- Notification sent
- May 7, 2024
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICFINANCIAL_ACCOUNTIDENTITY_GOVERNMENT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid AccountsT1114 Email Collection
- Threat actor
- External
- Initial access
- valid_credentials
Compliance
- Time to disclose
- 8 weeks(56 days from discovery to filing)
- Compliance flags
- CA 60-day OK · 56d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Mar 12, 2024→ Notified: May 7, 202456d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.