MalwareFinancial ServicesFinanceRansomwareSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

Impact Bank

bd_881a17907be1b0a4 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 22, 2020

Filed

Dec 4, 2020

To disclose

6 weeks

Affected

1state residents only

Linked

3 filings

Confidence

66%

Full breach record for Impact Bank →

Impact Bank notified Montana residents of a data breach involving its third-party vendor, American Bank Systems (ABS). On October 22, 2020, ABS was infected by malware, leading to unauthorized access of customer files containing names, addresses, bank account numbers, and SSNs. Impact Bank engaged forensic specialists, reset passwords, and provided complimentary credit monitoring via TransUnion.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 6 weeks / 43 days

Oct 22, 2020

Begins

Oct 22, 2020

Discovered

Dec 4, 2020

Filed

vs. sector median

2 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Indiana State AGbd_03f0228b38c7554f2020-12-04Verified
Massachusetts State AGbd_dc766464ac344bd52020-12-07 · +3dVerified

Name: Impact Bank
norm: impact bank

Name: Impact Bank
norm: impact bank
Industry: Financial Servicesllm

Discovered: Oct 22, 2020
Breach occurred: Oct 22, 2020
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security number
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Third party: via American Bank Systems
Initial access: supply_chain

During the incident: ABS immediately took steps to assess the security of its systems and mitigate the impact of this incident
Resetting their passwords
Reviewed existing security policies and implemented additional measures, including advanced endpoint monitoring
Arranged for ABS to offer complimentary credit monitoring and identity theft restoration services through myTrueIdentity provided by TransUnion Interactive
Changes made: Implemented additional measures, including advanced endpoint monitoring
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(43 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Indiana State AGDec 4 · first

Montana State AGDec 4 · first · this page

Massachusetts State AG+3d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/impactSamp.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 4, 2020
Raw hash: 656788dc531a4e99ad422221afdb1297f1cffec226b046e011268e3c4178d28e

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityImpact Bank

Victim entityImpact Bank

Incidentdiscovered Oct 22, 2020

Stated responseABS immediately took steps to assess the security of its systems and mitigate the impact of this incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov