HackingVulnerability ExploitSupply Chain (3P Vendor)Customer Data InvolvedIDENTITY_BASICLowContained
Hatch
bd_9dbaa312cfff98b4 · schema v1 · pii pii-v1
Full breach record for Hatch →Hatch Bank notified customers of a cyber incident involving its third-party technology vendor, Fortra. Between January 30 and 31, 2023, unauthorized access occurred to files on Fortra's GoAnywhere site due to a software vulnerability. Hatch Bank was notified on February 3, 2023. The incident potentially impacted customer names. Hatch Bank launched an internal investigation and is offering credit monitoring services.
California clockDiscovered Feb 3, 2023 → Notified Feb 28, 202325d ✓ CA 60-day OK25 days discovery → filing
This filing is one of 6 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (5) · sorted by filing gap
- bd_6a0fbcf8d7c0d53aWashington State AGfiled 2023-02-28Candidate
- bd_7138750bbfb556dcVermont State AGfiled 2023-02-28Verified
- bd_dbb2e668d0b81195Oregon State AGfiled 2023-02-28Verified
- bd_f5981ae8f8ed8013Montana State AGfiled 2023-02-28Verified
Show 1 more filing ↓Show fewer ↑up to 6d gap
- bd_30fc3880baa08a9eNew Hampshire State AGfiled 2023-03-06(6d gap)Verified
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-563714
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Feb 28, 2023
- Raw hash
- fa049b4ef600f69ba45cf0d1d45cbd06871792e86b83fe04ea46757a723c33e1
Reporting entity
- Name
- Hatchnorm: hatch
- Domain
- hatch.com
Victim entity
- Name
- Hatchnorm: hatch
- Domain
- hatch.com
Incident
- Discovered
- Feb 3, 2023
- Materiality determined
- —
- Notification sent
- Feb 28, 2023
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASIC
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1190 Exploit Public-Facing Application
- Threat actor
- External
- Third party
- via Fortra
- Initial access
- supply_chain
Compliance
- Time to disclose
- 25 days(25 days from discovery to filing)
- Compliance flags
- CA 60-day OK · 25d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Feb 3, 2023→ Notified: Feb 28, 202325d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.