HackingFinancial ServicesFinanceStolen CredentialsCapture Stored DataSupply Chain (3P Vendor)Customer Data InvolvedData ExfiltratedPIIIdentity (basic)Government IDMediumContained

Bank of the West

bd_a9952dff3250661e · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Aug 20, 2018

To disclose

—

Affected

Not disclosed

Linked

4 filings

Confidence

80%

Full breach record for Bank of the West →10 incidents on file

Bank of the West notified customers of a third-party data breach in which unauthorized parties used compromised credentials to access employee email accounts at a contracted business data analysis service provider. The incident, which occurred on March 2, 2018, potentially exposed business customer names and business identification numbers (which may include Social Security numbers). Bank of the West offered one year of free Identity Guard® credit monitoring services to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

Mar 2, 2018

Begins

Aug 20, 2018

Filed

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Montana State AGbd_9f46f790366be3952018-08-20Candidate
New Hampshire State AGbd_898f7df75b36945a2018-08-24 · +4dVerified
Massachusetts State AGbd_1c0763a57a3216f42018-08-27 · +7dVerified

Name: Bank of the West
norm: bank of the west

Name: Bank of the West
norm: bank of the west
Industry: Financial Servicesllm

Discovered: —
Breach occurred: Mar 2, 2018
Materiality determined: —
Notification sent: Aug 20, 2018
Affected individuals: Not disclosed
Data types: PIIIdentity (basic)Government ID
Data elements: Social Security number
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: Federal law enforcement notified by the service provider
Initial access: valid_credentials

During the incident: Immediately took action upon receiving the data file on March 19, 2018
Conducted significant analysis to identify potentially affected individuals and associated mailing addresses
The responsible service provider engaged a cybersecurity forensics firm
The responsible service provider notified Federal law enforcement as soon as they identified the issue
Offering a year of free credit monitoring and identity theft protection services (Identity Guard®) to affected individuals
Changes made: The responsible service provider took steps to enhance their security protocols
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Montana State AGAug 20 · first

California State AGAug 20 · first · this page

New Hampshire State AG+4d

Massachusetts State AG+7d

Pattern: first filing Aug 20 (MT), last Aug 27 (MA) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-139041
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 20, 2018
Raw hash: a0168d600aaf73eb84718f5bff04c4233c6e165e7aaae018b7c746ed0facb1b2

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityBank of the West

Victim entityBank of the West

IncidentThird-Party / Supply Chain

Stated responseImmediately took action upon receiving the data file on March 19, 2018

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov