MalwareFinancial ServicesFinanceRansomwareStolen CredentialsDaixinRansom DemandedData ExfiltratedData EncryptedSupply Chain (3P Vendor)Customer Data InvolvedMulti-Stage ChainIdentity (basic)Government IDFinancial accountMediumContained

Webster Bank, National Association

bd_b26f4a157e67d25b · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 26, 2023

Filed

Apr 12, 2023

To disclose

11 weeks

Affected

348state residents only

Linked

5 filings

Confidence

66%

Full breach record for Webster Bank, National Association →6 incidents on file

Webster Bank, N.A. notified the New Hampshire Attorney General of a third-party vendor breach involving Guardian Analytics, Inc. A ransomware attack (Daixin/LockBit) on Guardian's systems between Nov 27, 2022 and Jan 17, 2023 resulted in the exfiltration and encryption of Webster customer data. Webster discovered the incident on Jan 26, 2023. 348 New Hampshire residents were affected, with data including names, account numbers, and potentially SSNs. Webster offered 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 60 days

discovery → filing · 11 weeks / 76 days

Nov 27, 2022

Begins

Jan 26, 2023

Discovered

Feb 10, 2023

Scope determined

Apr 12, 2023

Filed

vs. sector median

+2 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Massachusetts State AGbd_284b5e4097e910832023-04-10 · +2dVerified
Maine State AGbd_8dd6fb8c661b3b582023-04-10 · +2dCandidate
Maine State AGbd_519c51969ff5e9872023-04-28 · +16dVerified
New Hampshire State AGbd_8b98ad645053816c2023-05-03 · +21dVerified

Name: Webster Bank, National Association
norm: webster bank national

Name: Webster Bank, National Association
norm: webster bank national
Industry: Financial Servicesllm

Discovered: Jan 26, 2023
Breach occurred: Nov 27, 2022 – Jan 17, 2023
Undetected for: 60 daysoccurrence → discovery
Materiality determined: Feb 10, 2023
Notification sent: Apr 10, 2023
Affected individuals: 348state-resident count only
Data types: Identity (basic)Government IDFinancial account
Attack vector: Ransomware
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid AccountsT1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: DaixinExternalFinancial
Regulator citations: Provided preliminary notice to the Office of the Comptroller of the Currency ("OCC")Provided preliminary notice to the Federal Reserve Board of New York ("FRB NY")Guardian notified law enforcement and is cooperating with their investigation
Third party: via Guardian Analytics, Inc.
Initial access: external_remote_services

During the incident: Reached out to Guardian to ascertain more details on the attack
Began pulling data down from the dark web to review it
Provided preliminary notice to regulators, including the Office of the Comptroller of the Currency ("OCC") and the Federal Reserve Board of New York ("FRB NY")
Undertook independent review of stolen data at its own expense
Began notifying individuals who had some combination of personal information
Offering all individuals 24-months of complimentary credit monitoring and fraud protection services
Working with Guardian to ensure that Guardian implements enhanced security measures
Retained third parties to assist with independent investigation
Notified law enforcement
Changes made: Working with Guardian to ensure that Guardian implements enhanced security measures to safeguard its network, systems, and data
Reviewing its relationship with Guardian going forward
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 weeks(76 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 3 states

View merged incident ↗

Massachusetts State AGApr 10 · first

Maine State AGApr 10 · first

New Hampshire State AG+2d · this page

Maine State AG+18d

New Hampshire State AG+23d

Pattern: first filing Apr 10 (MA), last May 3 (NH) — a 23-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/webster-bank-20230412.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 12, 2023
Raw hash: abc6c8115f3ae422dcd270cbb9c6860784260b1f3ef4fcb1c956f9d726bf9c55

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityWebster Bank, National Association

Victim entityWebster Bank, National Association

Incidentdiscovered Jan 26, 2023

Stated responseReached out to Guardian to ascertain more details on the attack

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov