HackingFinancial ServicesFinanceVulnerability ExploitSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedPIIIdentity (basic)LowContained

TBK BANK, SSB

bd_ab4505c4f85d3473 · schema v1 · pii pii-v1

Severity

Low

Discovered

Aug 8, 2023

Filed

Oct 31, 2023

To disclose

12 weeks

Affected

3state residents only

Linked

2 filings

Confidence

66%

Full breach record for TBK BANK, SSB →3 incidents on file

TBK Bank, SSB notified Montana residents of a data breach involving customer personal information disclosed via a third-party service provider, Fiserv. The incident resulted from the exploitation of a vulnerability in MOVEit Transfer software between May 27-31, 2023. TBK Bank was notified on August 8, 2023, launched an investigation, engaged forensic experts, and offered 24 months of identity protection services.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 73 days

discovery → filing · 12 weeks / 84 days

May 27, 2023

Begins

Aug 8, 2023

Discovered

Oct 31, 2023

Filed

vs. sector median

+4 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_9e8e40d1070c73302023-10-31Verified

Name: TBK BANK, SSB
norm: tbk bank ssb

Name: TBK BANK, SSB
norm: tbk bank ssb
Industry: Financial Servicesllm

Discovered: Aug 8, 2023
Breach occurred: May 27, 2023 – May 31, 2023
Undetected for: 73 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 3state-resident count only
Data types: PIIIdentity (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Contacted law enforcement
Third party: via Fiserv
Initial access: exploit_public_facing

During the incident: Launched a comprehensive investigation
Worked to identify which TBK Bank customers may have had their information impacted
Disabled the unauthorized access to Progress Software’s MOVEit Transfer system
Patched the MOVEit environment to remediate the vulnerabilities
Mobilized a technical response team of third party forensic experts
Contacted law enforcement
Offering 24 months of free fraud detection and identity theft protection through Kroll
Changes made: Patched the MOVEit environment to remediate the vulnerabilities according to Progress Software’s security guidance
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 weeks(84 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGOct 31 · first

Montana State AGOct 31 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-808.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 31, 2023
Raw hash: 1bd33e6c1e1a44cce9a6d7d4cd2dd9ed8987fe9150af910244859c1a8318f477

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityTBK BANK, SSB

Victim entityTBK BANK, SSB

Incidentdiscovered Aug 8, 2023

Stated responseLaunched a comprehensive investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov