HackingFinancial ServicesFinanceVulnerability ExploitSupply Chain (3P Vendor)TargetedIdentity (basic)Government IDMediumContained

1st Source Bank

bd_a872f10fb82b1c59 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 1, 2023

Filed

Jul 14, 2023

To disclose

6 weeks

Affected

Not disclosed

Linked

10 filings

Confidence

67%

Full breach record for 1st Source Bank →6 incidents on file

1st Source Bank notified Vermont consumers of a data breach linked to the MOVEit file transfer software vulnerability. The incident, discovered June 1, 2023, potentially exposed names, SSNs, driver's license numbers, and dates of birth. The bank patched its system, engaged forensic experts, and offered 12 months of identity monitoring through Kroll.

J jump to incidentP pin to compareR raw source

Vermont clock⏱ VT AG >14 bday6 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

discovery → filing · 6 weeks / 43 days

Jun 1, 2023

Discovered

Jul 14, 2023

Filed

vs. sector median

4 wks faster

This filing is one of 10 filings about the same incident.View merged incident

Part of Progress Software Corporation supply-chain incident (2023) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (9) · sorted by filing gap

SEC 8-Kbd_66ec9f2d6644e6032023-07-10 · +4dVerified
California State AGbd_504a71c703e7184f2023-07-19 · +5dVerified
Montana State AGbd_644846888cf47c7f2023-07-19 · +5dVerified
Maine State AGbd_ee5f8afdf477969e2023-07-19 · +5dVerified

Show 5 more filings ↓up to 13d gap

Washington State AGbd_d0cebba25691bccf2023-07-20 · +6dVerified
Oregon State AGbd_db8e5883d0d70d122023-07-20 · +6dVerified
California State AGbd_4a59c8811709f62b2023-07-26 · +12dVerified
New Hampshire State AGbd_fda2be588d0437762023-07-26 · +12dVerified
Oregon State AGbd_08c27ccfede4e9ef2023-07-27 · +13dVerified

Name: 1st Source Bank
norm: 1st source bank

Name: 1st Source Bank
norm: 1st source bank
Industry: Financial Servicesllm

Discovered: Jun 1, 2023
Materiality determined: —
Notification sent: Jul 14, 2023
Affected individuals: Not disclosed
Data types: Identity (basic)Government ID
Data elements: Social Security numberDate of birth
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Engaged leading, independent cybersecurity experts to conduct a comprehensive investigation
Secured the services of Kroll to provide complimentary Identity Monitoring services for 12 months
Changes made: Patched MOVEit system in accordance with Progress Software’s instructions
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(43 days from discovery to filing)
Compliance flags: VT AG >14 bday
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 10 filings · 7 states

View merged incident ↗

SEC 8-KJul 10 · first

Vermont State AG+4d · this page

California State AG+9d

Montana State AG+9d

Maine State AG+9d

Washington State AG+10d

Oregon State AG+10d

California State AG+16d

New Hampshire State AG+16d

Oregon State AG+17d

Pattern: first filing Jul 10, last Jul 27 (OR) — a 17-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2023-07-14-1st-source-bank-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 14, 2023
Raw hash: aeae51c30f0c315bddd6d656db21d7eec662da7b5e22fb655820d67b482a69ee

Linked disclosures

Regulatory filings (9) · sorted by filing gap

Reporting entity1st Source Bank

Victim entity1st Source Bank

Incidentdiscovered Jun 1, 2023

Stated responseEngaged leading, independent cybersecurity experts to conduct a comprehensive investigation

ComplianceVT AG >14 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov