HackingFinancial ServicesFinanceSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedPIIIdentity (basic)Government IDMediumContained

Webster Bank, National Association

bd_8b98ad645053816c · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 26, 2023

Filed

May 3, 2023

To disclose

14 weeks

Affected

16state residents only

Linked

5 filings

Confidence

66%

Full breach record for Webster Bank, National Association →6 incidents on file

Webster Bank NA filed a supplemental notice with the New Hampshire Attorney General regarding a data breach involving third-party vendor Guardian Analytics, Inc. Unauthorized third parties accessed Guardian's systems between November 27, 2022, and January 22, 2023, exfiltrating client personal information. Webster learned of the incident on January 26, 2023. The notice covers 16 additional New Hampshire residents. Webster offered 24 months of Experian IdentityWorks.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 60 days

discovery → filing · 14 weeks / 97 days

Nov 27, 2022

Begins

Jan 26, 2023

Discovered

May 3, 2023

Filed

vs. sector median

+6 wks slower

This filing is one of 5 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Maine State AGbd_519c51969ff5e9872023-04-28 · +5dVerified
New Hampshire State AGDaixinbd_b26f4a157e67d25b2023-04-12 · +21dVerified
Massachusetts State AGbd_284b5e4097e910832023-04-10 · +23dVerified
Maine State AGbd_8dd6fb8c661b3b582023-04-10 · +23dCandidate

Name: Webster Bank, National Association
norm: webster bank national

Name: Webster Bank, National Association
norm: webster bank national
Industry: Financial Servicesllm

Discovered: Jan 26, 2023
Breach occurred: Nov 27, 2022 – Jan 22, 2023
Undetected for: 60 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 10, 2023
Affected individuals: 16state-resident count only
Data types: PIIIdentity (basic)Government ID
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Guardian notified law enforcement and is cooperating with their investigation
Third party: via Guardian Analytics, Inc.
Initial access: supply_chain

During the incident: Retained third parties to assist with independent investigation
Working with Guardian to ensure they implement enhanced security measures
Offering 24-month membership of Experian's IdentityWorks at no cost
Changes made: Guardian implementing enhanced security measures to safeguard network, systems, and data
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 weeks(97 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 3 states

View merged incident ↗

Massachusetts State AGApr 10 · first

Maine State AGApr 10 · first

New Hampshire State AG+2d

Maine State AG+18d

New Hampshire State AG+23d · this page

Pattern: first filing Apr 10 (MA), last May 3 (NH) — a 23-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/webster-bank-20230503.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 3, 2023
Raw hash: 5cec33246381abfa8d64fa8d9d52a76207dada6321e312228d4391008e38b9ac

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityWebster Bank, National Association

Victim entityWebster Bank, National Association

Incidentdiscovered Jan 26, 2023

Stated responseRetained third parties to assist with independent investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov