DisclosureLens
HackingFinancial ServicesFinanceHacking OtherCustomer Data InvolvedPIIGovernment IDCriticalContained

Webster Bank, National Association

bd_8dd6fb8c661b3b58 · schema v1 · pii pii-v1

Severity

Critical

Discovered

Jan 27, 2023

Filed

Apr 10, 2023

To disclose

10 weeks

Affected · nationwide

191,563240 in this filing

Linked

5 filings

Confidence

50%
Full breach record for Webster Bank, National Association →6 incidents on file

Webster Bank, N.A. identified a security breach that affected its systems between November 27, 2022, and January 22, 2023. The breach was discovered on January 27, 2023. The incident involved an external party hacking into the bank's systems and acquiring personal information, including names and Social Security numbers. A total of 191,563 individuals were affected, with 240 of them being residents of Maine. Webster Bank began notifying the affected individuals on April 10, 2023, and offered them 24 months of identity theft protection services through Experian.

Maine clockDiscovered Jan 27, 2023 → Filed with AG Apr 10, 202373d ⏱ ME AG >30d10 weeks discovery → filing
⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 61 days
discovery → filing · 10 weeks / 73 days

Nov 27, 2022

Begins

Jan 27, 2023

Discovered

Apr 10, 2023

Filed

vs. sector median

+2 wks slower

This filing is one of 5 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Filing propagation · 5 filings · 3 states

View merged incident ↗
Massachusetts State AGApr 10 · first
Maine State AGApr 10 · first · this page

Pattern: first filing Apr 10 (MA), last May 3 (NH) — a 23-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.