MalwareFinancial ServicesFinanceRansomwareSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

Carson Bank

bd_a0b5f9fc0e2a3c26 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 18, 2020

Filed

Dec 28, 2020

To disclose

6 weeks

Affected

9state residents only

Linked

5 filings

Confidence

66%

Full breach record for Carson Bank →

Carson Bank notified customers of a data breach involving its third-party vendor, American Bank Systems (ABS). ABS was infected with malware on October 22, 2020, leading to unauthorized access of customer files containing names, addresses, bank account numbers, and SSNs. Carson Bank reported the incident on November 18, 2020, and offered credit monitoring services.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 27 days

discovery → filing · 6 weeks / 40 days

Oct 22, 2020

Begins

Nov 18, 2020

Discovered

Dec 28, 2020

Filed

vs. sector median

4 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Maine State AGbd_bd69c6891ac259e02020-12-28Verified
Indiana State AGbd_d9447367c67a15ab2020-12-28Verified
New Hampshire State AGbd_4c26bef928b783e82020-12-29 · +1dVerified
Massachusetts State AGbd_63716669be86559e2020-12-29 · +1dVerified

Name: Carson Bank
norm: carson bank
Domain: carsonbank.com

Name: Carson Bank
norm: carson bank
Domain: carsonbank.com
Industry: Financial Servicesllm

Discovered: Nov 18, 2020
Breach occurred: Oct 22, 2020
Undetected for: 27 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 9state-resident count only
Data types: Identity (basic)Government IDFinancial account
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Third party: via American Bank Systems

During the incident: ABS immediately took steps to assess the security of its systems and mitigate the impact of this incident
ABS reviewed existing security policies and implemented additional measures, including advanced endpoint monitoring
ABS is offering complimentary credit monitoring and identity theft restoration services through myTrueIdentity provided by TransUnion Interactive
Changes made: Implemented additional measures, including advanced endpoint monitoring
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(40 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Maine State AGDec 28 · first

Indiana State AGDec 28 · first

Montana State AGDec 28 · first · this page

New Hampshire State AG+1d

Massachusetts State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Carson-Notif.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 28, 2020
Raw hash: 9d08136638bb16e5b1e92264e2552cff025ba59b389a5a5bdab551ca116c1cab

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityCarson Bank

Victim entityCarson Bank

Incidentdiscovered Nov 18, 2020

Stated responseABS immediately took steps to assess the security of its systems and mitigate the impact of this incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov