Social EngineeringFinancial ServicesFinancePhishingStolen CredentialsCustomer Data InvolvedPIIIdentity (basic)LowContained

Merchants Bank

bd_b60475e980b24cf4 · schema v1 · pii pii-v1

Severity

Low

Discovered

Mar 27, 2023

Filed

Jun 21, 2023

To disclose

12 weeks

Affected

156state residents only

Confidence

66%

Full breach record for Merchants Bank →3 incidents on file

Merchants Bank notified Montana residents of unauthorized access to an employee email account between March 21-27, 2023. The bank engaged forensic specialists and determined names were present in the account. No evidence of misuse was found, but 24 months of identity monitoring via Kroll was offered.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 6 days

discovery → filing · 12 weeks / 86 days

Mar 21, 2023

Begins

Mar 27, 2023

Discovered

Jun 21, 2023

Filed

vs. sector median

+3 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed156 affectedView incident

Name: Merchants Bank
norm: merchants bank

Name: Merchants Bank
norm: merchants bank
Industry: Financial Servicesllm

Discovered: Mar 27, 2023
Breach occurred: Mar 21, 2023 – Mar 27, 2023
Undetected for: 6 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 156state-resident count only
Data types: PIIIdentity (basic)
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid Accounts
Threat actor: External
Regulator citations: notifying regulators, as necessary
Initial access: phishing_link

During the incident: Launched an investigation into the nature and scope of the event with the assistance of third party forensic specialists
Undertook a comprehensive and time-intensive review of all potentially impacted files with the assistance of third-party data review specialists
Offering you access to twenty four (24) months of identity monitoring services through Kroll at no cost to you
Notifying regulators, as necessary
Changes made: Implementing additional technical security measures to strengthen the security of our systems
Reviewing and enhancing our existing data privacy policies and procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 weeks(86 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-359.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 21, 2023
Raw hash: aa94b0a4563e5ae49c6bc4f782f24bae960476fbfeefd04b5b07ecd3d50e3291

Reporting entityMerchants Bank

Victim entityMerchants Bank

Incidentdiscovered Mar 27, 2023

Stated responseLaunched an investigation into the nature and scope of the event with the assistance of third party forensic specialists

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov