HackingFinancial ServicesFinanceVulnerability ExploitZero-DaySupply Chain (3P Vendor)Customer Data InvolvedFinancial accountIdentity (basic)CVE-2023-3462LowContained

Alogent

bd_b3d9698efebd17ae · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Sep 26, 2023

To disclose

—

Affected

Not disclosed

Linked

10 records

Confidence

66%

Full breach record for Alogent →

Alogent Holdings, Inc. disclosed a data breach affecting customer data processed for Huntington Bank. Between May 30 and June 1, 2023, an unauthorized party exploited a zero-day vulnerability (CVE-2023-3462) in Progress Software's MOVEit Transfer application, a third-party vendor solution. Exposed data included account and routing numbers, names, addresses, phone numbers, check payees, and remittance amounts. Alogent discontinued the use of the affected software and is offering identity theft protection services through IDX.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >30d

⚠ no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

Incident timeline

May 30, 2023

Begins

Sep 26, 2023

Filed

This filing is one of 10 records about the same incident.View merged incident

Part of Progress Software Corporation supply-chain incident (2023) — a supply-chain cascade affecting multiple organizations.View cascade →

A leak claim by cl0p about this victim was first seen 62 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitecl0pbd_88c243c3d3c295ca2023-07-26 · +62dVerified by operator

Regulatory filings (8) · sorted by filing gap

Oregon State AGbd_bc4d72b1dbff67b42023-09-18 · +8dVerified
Maine State AGbd_c9b3d1793f71fb032023-08-31 · +26dVerified
Maine State AGbd_4a4a783af181541b2023-08-29 · +28dVerified
Washington State AGbd_0d9a92be61a8ab372023-08-22 · +35dVerified

Show 4 more filings ↓up to 268d gap

Montana State AGbd_ad229b8cf70b7a592023-08-18 · +39dVerified
Indiana State AGbd_18e5e916b12d5e7c2023-08-14 · +43dVerified by operator
Delaware State AGbd_095fa3b99741152a2023-07-12 · +76dCandidate
Illinois State AGbd_e3ee5926a60b917f2023-01-01 · +268dVerified by operator

Name: Alogent
norm: alogent
Domain: alogent.com

Name: Alogent
norm: alogent
Domain: alogent.com
Industry: Financial Servicesllm

Discovered: —
Breach occurred: May 30, 2023 – Jun 1, 2023
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Financial accountIdentity (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1195 Supply Chain Compromise
Threat actor: External
Initial access: supply_chain
CVE references: CVE-2023-3462

During the incident: Discontinued the use of the MOVEit Transfer software after the compromise was discovered
Working to replace this solution
Offering identity theft protection services through IDX, A ZeroFox Company
Changes made: Establish improved security measures to mitigate risk in the future
Source: Quoted from the filing itself, not independently verified.

Compliance flags: Leak >30d
Discovery-date grounding: no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 8 states

View merged incident ↗

Illinois State AGJan 1 · first

Delaware State AG+192d

Indiana State AG+225d

Montana State AG+229d

Washington State AG+233d

Maine State AG+240d

Maine State AG+242d

Oregon State AG+260d

California State AG+268d · this page

Pattern: first filing Jan 1 (IL), last Sep 26 (CA) — a 268-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-574245
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 26, 2023
Raw hash: 50f574b8e4f61eebe3c5b8a852e43de87d83b2ccf507d1ccaf76c0fa19354608

Linked disclosures

Ransomware claims (1)

Regulatory filings (8) · sorted by filing gap

Reporting entityAlogent

Victim entityAlogent

IncidentThird-Party / Supply Chain

Stated responseDiscontinued the use of the MOVEit Transfer software after the compromise was discovered

ComplianceLeak >30d

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov