Social EngineeringFinancial ServicesFinancePhishingStolen CredentialsCustomer Data InvolvedMulti-Stage ChainPIIIdentity (basic)LowContained

Summit National Bank

bd_bda5a21c57d9a419 · schema v1 · pii pii-v1

Severity

Low

Discovered

May 15, 2024

Filed

Aug 16, 2024

To disclose

13 weeks

Affected

8state residents only

Linked

5 filings

Confidence

65%

Full breach record for Summit National Bank →2 incidents on file

Summit National Bank notified New Hampshire and Rhode Island residents of a data incident where an unauthorized actor accessed an email account between May 13-16, 2024, following suspicious activity discovered on May 15, 2024. The breach potentially exposed personal information of customers dating back to 2009. The bank engaged forensic specialists, notified regulators and credit bureaus, and offered credit monitoring services.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 2 days

discovery → filing · 13 weeks / 93 days

May 13, 2024

Begins

May 15, 2024

Discovered

Jul 12, 2024

Scope determined

Aug 16, 2024

Filed

vs. sector median

+5 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Massachusetts State AGbd_031ae01024263b8f2024-08-16Verified
Maine State AGbd_47b7e0fcd0cb02a02024-08-16Candidate
Vermont State AGbd_4967d7c063f597d82024-08-16Verified
Montana State AGbd_8b42e95fdae448d42024-08-16Verified

Name: Summit National Bank
norm: summit national bank

Name: Summit National Bank
norm: summit national bank
Industry: Financial Servicesllm

Discovered: May 15, 2024
Breach occurred: May 13, 2024 – May 16, 2024
Undetected for: 2 daysoccurrence → discovery
Materiality determined: Jul 12, 2024
Notification sent: Jul 15, 2024
Affected individuals: 8state-resident count only
Data types: PIIIdentity (basic)
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: providing written notice of this incident to relevant state and federal regulators
Initial access: phishing_link

During the incident: Moved quickly to investigate and respond to the incident
Assess the security of SNB systems
Identify potentially affected individuals
With the assistance of third-party forensic specialists, began an investigation
Initiated a review of the type of data located within that email account
Providing access to credit monitoring services for , through Experian, to individuals whose personal information was potentially affected by this incident, at no cost to these individuals
Providing impacted individuals with guidance on how to better protect against identity theft and fraud
Providing individuals with information on how to place a fraud alert and security freeze on one’s credit file
Providing written notice of this incident to relevant state and federal regulators
Providing written notice... to the three major credit reporting agencies, Equifax, Experian, and TransUnion
Changes made: Implement additional safeguards and training to its employees
Assess and further strengthen the security of our systems and computer environment
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 weeks(93 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Massachusetts State AGAug 16 · first

Maine State AGAug 16 · first

Vermont State AGAug 16 · first

Montana State AGAug 16 · first

New Hampshire State AGAug 16 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/summit-national-bank-20240816.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 16, 2024
Raw hash: a20812ca1757e3254fce89685aa2683f8fef1be8def28095ef9e24717832327d

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entitySummit National Bank

Victim entitySummit National Bank

Incidentdiscovered May 15, 2024

Stated responseMoved quickly to investigate and respond to the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov