HackingVulnerability ExploitSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedFINANCIAL_ACCOUNTIDENTITY_BASICLowContained

STATE STREET CORPORATION

bd_bef5c97e12364fef · schema v1 · pii pii-v1

Full breach record for STATE STREET CORPORATION →

State Street Corporation notified the NH AG of a breach involving its third-party provider Fiserv. An unauthorized actor exploited a vulnerability in MOVEit Transfer between May 27-31, 2023, accessing check images containing financial account info for one NH resident. State Street discovered the incident on Dec 20, 2023, and notified the individual on Jan 31, 2024. Remediation included patching and offering credit monitoring.

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

bd_8e6752fdd7e9fdd7Indiana State AGfiled 2024-02-01(1d gap)Candidate

Source provenance

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/state-street-20240131.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 31, 2024
Raw hash: 57361203bff0c5986a437b1d73f461ad087cda9dbc9ec66e774a434f4a8cc571

Reporting entity

Name: STATE STREET CORPORATION
norm: state street

Victim entity

Name: STATE STREET CORPORATION
norm: state street

Incident

Discovered: Dec 20, 2023
Materiality determined: —
Notification sent: Jan 31, 2024
Affected individuals: 1
Data types: FINANCIAL_ACCOUNTIDENTITY_BASIC
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General
Third party: via Fiserv
Initial access: exploit_public_facing

Compliance

Time to disclose: 6 weeks(42 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Extraction provenance

Status: No extraction artifact recorded for this disclosure.