HackingVulnerability ExploitZero-DayData ExfiltratedSupply Chain (3P Vendor)IDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTMediumContained
Cadence Bank
bd_9eeb910d8c5188af · schema v1 · pii pii-v1
Full breach record for Cadence Bank →Cadence Bank notified Vermont residents of a data breach involving the MOVEit Transfer application by Progress Software. An unauthorized third party exploited a zero-day vulnerability to access and download personal information (names, SSNs, driver's licenses, financial account data) between May 28-31, 2023. Cadence engaged forensic investigators, reported to law enforcement, and offered credit monitoring.
Vermont clock✗ VT AG >45 bday15 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 3 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (2) · sorted by filing gap
- bd_3a402a6f99ec3eccCalifornia State AGfiled 2023-09-15Verified
- bd_d1a549216a802d0fMontana State AGfiled 2023-09-15Candidate
Source provenance
- Source URL
- https://ago.vermont.gov/document/2023-09-15-cadence-bank-progress-software-moveit-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Sep 15, 2023
- Raw hash
- 95c4ad4b9b9341eab626b1a496ebeb6fef9d909994c77e91abe4c160986d35cb
Reporting entity
- Name
- Cadence Banknorm: cadence bank
Victim entity
- Name
- Cadence Banknorm: cadence bank
Incident
- Discovered
- Jun 1, 2023
- Materiality determined
- Aug 16, 2023
- Notification sent
- Sep 15, 2023
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNT
- Attack vector
- Misconfiguration
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
- Threat actor
- ExternalFinancial
- Regulator citations
- reported the matter to law enforcement
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 15 weeks(106 days from discovery to filing)
- Compliance flags
- VT AG >45 bday
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.