HackingFinancial ServicesFinanceVulnerability ExploitSupply Chain (3P Vendor)Data ExfiltratedIdentity (basic)Government IDMediumContained

Northfield Bank

bd_9963040c41fa4926 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 4, 2023

Filed

Sep 8, 2023

To disclose

5 weeks

Affected

Not disclosed

Linked

7 filings

Confidence

65%

Full breach record for Northfield Bank →

Northfield Bank notified New Hampshire residents of a data security event involving a third-party vendor's use of MOVEit Transfer software. The incident occurred between May 27 and May 31, 2023, and the bank was notified on August 4, 2023. The breach potentially exposed customer personal information, including government identifiers, via vulnerabilities in the vendor's file transfer application. Northfield Bank engaged cybersecurity specialists and provided credit monitoring services through Kroll to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 69 days

discovery → filing · 5 weeks / 35 days

May 27, 2023

Begins

Aug 4, 2023

Discovered

Sep 8, 2023

Filed

vs. sector median

4 wks faster

This filing is one of 7 about the same incident.View merged incident

Part of Progress Software Corporation supply-chain incident (2023) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Massachusetts State AGbd_05cc028fdb8910792023-09-08Verified
Vermont State AGbd_e04b124b7a8d579e2023-09-08Candidate
Maine State AGbd_79fd0089944d11242023-09-07 · +1dCandidate
Indiana State AGbd_2d7bc11eba226abc2023-09-25 · +17dVerified

Show 2 more filings ↓up to 24d gap

Vermont State AGbd_d86ff387ddb8a86a2023-09-25 · +17dVerified
New Hampshire State AGbd_d9885b4724d481062023-10-02 · +24dVerified

Name: Northfield Bank
norm: northfield bank

Name: Northfield Bank
norm: northfield bank
Industry: Financial Servicesllm

Discovered: Aug 4, 2023
Breach occurred: May 27, 2023 – May 31, 2023
Undetected for: 69 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 7, 2023
Affected individuals: Not disclosed
Data types: Identity (basic)Government ID
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: Partner
Regulator citations: providing notice of this incident to relevant state and federal regulators
Initial access: exploit_public_facing

During the incident: Began working with our vendor to monitor their investigation and remediation, and identify customers affected
Vendor mobilized a technical response team to examine the relevant MOVEit Transfer systems
Vendor remediated all technical vulnerabilities and patched systems
Engaged cyber security specialists to assist us in monitoring their investigation and remediation
Providing individuals whose personal information was potentially impacted by this event access to credit monitoring services for through Kroll at no cost to the individuals
Providing impacted individuals with guidance on how to better protect against identity theft and fraud
Providing notice of this incident to relevant state and federal regulators
Changes made: Vendor remediated all technical vulnerabilities and patched systems in accordance with the MOVEit software provider’s guidelines
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(35 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 5 states

View merged incident ↗

Maine State AGSep 7 · first

Massachusetts State AG+1d

Vermont State AG+1d

New Hampshire State AG+1d · this page

Indiana State AG+18d

Vermont State AG+18d

New Hampshire State AG+25d

Pattern: first filing Sep 7 (ME), last Oct 2 (NH) — a 25-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/northfield-bank-20230908.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 8, 2023
Raw hash: 8db4ab7b26d9901d8d1189ba64906647c044bb9716abb70bb7ee48f560455107

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityNorthfield Bank

Victim entityNorthfield Bank

Incidentdiscovered Aug 4, 2023

Stated responseBegan working with our vendor to monitor their investigation and remediation, and identify customers affected

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov