HackingVulnerability ExploitSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedPIIIDENTITY_BASICLowContained
First Hartford Bancshares
bd_ac5dc146c1739527 · schema v1 · pii pii-v1
Full breach record for First Hartford Bancshares →First National Bank of Hartford notified the NH AG of a third-party data security incident involving vendor Fiserv. Unauthorized actors exploited zero-day vulnerabilities in MOVEit Transfer software to download customer files between May 27-31, 2023. Fiserv notified the bank in June 2023. One NH resident was notified on Feb 26, 2024. Affected data includes personal information. Fiserv provided 24 months of identity monitoring via Kroll.
This filing is one of 4 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (3) · sorted by filing gap
- bd_069ff37cfdde6e9cIndiana State AGfiled 2024-02-26Verified
- bd_3b9789b3324122e1Montana State AGfiled 2024-02-26Candidate
- bd_0332f161a4dc591fMaine State AGfiled 2024-02-27(1d gap)Verified by operator
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/first-hartford-bancshares-dba-first-national-bank-hartford-20240226.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Feb 26, 2024
- Raw hash
- 86664a6084fbeaa46fd4ab7c4a01540ee69a31bf4555980f1f35f79b9f947a7c
Reporting entity
- Name
- First Hartford Bancsharesnorm: first hartford bancshares
Victim entity
- Name
- First Hartford Bancsharesnorm: first hartford bancshares
Incident
- Discovered
- Jun 1, 2023
- Materiality determined
- —
- Notification sent
- Feb 26, 2024
- Affected individuals
- 1
- Data types
- PIIIDENTITY_BASIC
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
- Threat actor
- ExternalFinancial
- Regulator citations
- Notified regulatory bodies as required
- Third party
- via Fiserv 2.0
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 39 weeks(270 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.