HackingFinancial ServicesFinanceVulnerability ExploitStolen CredentialsData ExfiltratedTargetedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

Leader Bank, National Association

bd_948e3dcd2132b2bb · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 26, 2017

Filed

Jun 6, 2017

To disclose

11 days

Affected

12state residents only

Linked

2 filings

Confidence

66%

Full breach record for Leader Bank, National Association →9 incidents on file

Leader Bank, N.A. notified the NH Attorney General of a security breach affecting its ZRent platform. A malicious actor exploited an upload feature on Dec 30, 2016, to access landlord data including bank accounts and SSNs. Discovered May 26, 2017. Up to 12 NH residents potentially affected. Bank patched vulnerability, engaged FBI, and offered 1 year of LifeLock credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 147 days

discovery → filing · 11 days

Dec 30, 2016

Begins

May 26, 2017

Discovered

Jun 6, 2017

Filed

vs. sector median

7 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_7adb17bdf8fd6f3f2017-06-08 · +2dVerified

Name: Leader Bank, National Association
norm: leader bank national
Domain: leaderbank.com
Industry: Financial Services

Name: Leader Bank, National Association
norm: leader bank national
Domain: leaderbank.com
Industry: Financial Services
Industry: Financial Servicesllm

Discovered: May 26, 2017
Breach occurred: Dec 30, 2016 – May 19, 2017
Undetected for: 147 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 7, 2017
Affected individuals: 12state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Date of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Office of the Attorney GeneralFiled IC3 reports with the federal authorities (FBI)
Initial access: exploit_public_facing

During the incident: Contacted the FBI regarding the specific losses and overall incident, including filing IC3 reports with the federal authorities
Cooperated and will continue to cooperate with authorities to provide all information to identify these malicious actors
Quarantined all malicious or potentially malicious files
Installed a software patch to ensure that malicious actors could not further utilize the upload picture feature
Implemented several other security upgrades to the ZRent platform to prevent unauthorized access
Established a plan of additional steps to be taken to ensure the vulnerability and security breach are properly addressed, including implementation of additional security features surrounding ZRent access as well as additional monitoring and logging
Began personally calling all potentially impacted landlord customers
Offering free credit monitoring and identity theft protection services from LifeLock for a period of one year to those ZRent landlords with information in the system prior to May 19, 2017
Continuing to monitor all ZRent systems and any Leader Bank accounts held by the affected ZRent landlord customers for any suspicious and unauthorized activity on an ongoing basis
Changes made: Installed a software patch to ensure that malicious actors could not further utilize the upload picture feature
Implemented several other security upgrades to the ZRent platform to prevent unauthorized access
Implementation of additional security features surrounding ZRent access
Additional monitoring and logging
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 days(11 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

New Hampshire State AGJun 6 · first · this page

Massachusetts State AG+2d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/leader-bank-20170607.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 6, 2017
Raw hash: c0509f76938bc28ef9673183e7b0fcdb3015b7fb0f608549a63d14bf048c9614

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityLeader Bank, National Association

Victim entityLeader Bank, National Association

Incidentdiscovered May 26, 2017

Stated responseContacted the FBI regarding the specific losses and overall incident, including filing IC3 reports with the federal authorities

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov