HackingFinancial ServicesFinanceVulnerability ExploitSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

FIRST FED BANK

bd_bb5757e4df6a4d55 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Aug 23, 2023

To disclose

—

Affected

2state residents only

Linked

3 filings

Confidence

67%

Full breach record for FIRST FED BANK →

First Fed Bank notified Montana and Rhode Island residents of a data breach involving third-party vendor Darling Consulting Group. On May 31, 2023, a vulnerability in MOVEit file transfer software allowed unauthorized access to files containing customer PII (names, SSNs, DOBs, account numbers). First Fed Bank systems were not directly accessed. The bank is offering one year of Experian credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

May 31, 2023

Begins

Aug 23, 2023

Filed

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_267e8e4074f7421d2023-08-23Verified
Maine State AGbd_567adb402af5a6842023-08-23Candidate

Name: FIRST FED BANK
norm: first fed bank

Name: FIRST FED BANK
norm: first fed bank
Industry: Financial Servicesllm

Discovered: —
Breach occurred: May 31, 2023
Materiality determined: —
Notification sent: —
Affected individuals: 2state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security numberDate of birth
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Third party: via Darling Consulting Group
Initial access: exploit_public_facing

During the incident: Working with DCG to investigate this incident and identify what information may have been involved
Exploring steps to help prevent a similar incident from occurring in the future, including reviewing our vendor relationships
Offering a complimentary one-year membership of Experian IdentityWorks Credit 3B
Changes made: Reviewing vendor relationships
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGAug 23 · first

Maine State AGAug 23 · first

Montana State AGAug 23 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-588.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 23, 2023
Raw hash: e294cd5b18f9be94190e5671f2ae28953b1a1852d1834c741b4f2d5f1b2f018c

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityFIRST FED BANK

Victim entityFIRST FED BANK

IncidentThird-Party / Supply Chain

Stated responseWorking with DCG to investigate this incident and identify what information may have been involved

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov