AccidentalFinancial ServicesFinanceData MishandlingCustomer Data InvolvedIdentity (basic)Government IDFinancial accountHighResolved

Rockland Trust Company

bd_c376284bad1e8b86 · schema v1 · pii pii-v1

Severity

High

Discovered

May 16, 2024

Filed

Sep 5, 2024

To disclose

16 weeks

Affected · nationwide

2,6143 in this filing

Linked

3 filings

Confidence

66%

Full breach record for Rockland Trust Company →269 incidents on file

Rockland Trust reported an inadvertent disclosure of personal information (names, addresses, SSNs, account numbers) from inactive Bill Pay accounts to an unaffiliated third-party financial institution via a vendor. The breach occurred on May 15, 2024, was discovered on May 16, 2024, and affected 2,614 individuals total (3 in Maine). Notices were sent on August 29, 2024, offering 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered May 16, 2024 → Filed with AG Sep 5, 2024112d ✗ ME AG >90d16 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 1 days

discovery → filing · 16 weeks / 112 days

May 15, 2024

Begins

May 16, 2024

Discovered

Sep 5, 2024

Filed

vs. sector median

+8 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_0de72c2a7ed385582024-09-05Verified
Vermont State AGbd_cc80333560a3415e2024-09-05Verified

Name: Rockland Trust Company
norm: rockland trust
Domain: rocklandtrust.com
Industry: Financial Services

Name: Rockland Trust Company
norm: rockland trust
Domain: rocklandtrust.com
Industry: Financial Services
Industry: Financial Servicesllm

Discovered: May 16, 2024
Breach occurred: May 15, 2024
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Aug 29, 2024
Affected individuals: 2,614state + nationwide
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security number
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: Partner
Regulator citations: Filed notification with Maine Attorney General
Initial access: trusted_relationship

During the incident: Vendor assessed the information that was disclosed
Vendor worked with the unaffiliated financial institution to delete the data
Obtained certification of destruction from the unaffiliated financial institution
Offered complimentary two-year membership of Experian’s IdentityWorks
Changes made: Offered complimentary two-year membership of Experian’s IdentityWorks
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 weeks(112 days from discovery to filing)
Compliance flags: ME AG >90d · 112dME resident >60d · 105d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: May 16, 2024
→ Filed with AG: Sep 5, 2024
112d 90 days ME AG >90d
Maine
Discovered: May 16, 2024
→ Notified: Aug 29, 2024
105d 60 days (analyst band; statutory cap is 30 days) ME resident >60d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: May 16, 2024 → Filed with AG: Sep 5, 2024	112d	90 days	ME AG >90d
Maine	Discovered: May 16, 2024 → Notified: Aug 29, 2024	105d	60 days (analyst band; statutory cap is 30 days)	ME resident >60d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGSep 5 · first

Vermont State AGSep 5 · first

Maine State AGSep 5 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/f9c4f3e1-687a-499e-8ebf-287d93eed698.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 5, 2024
Raw hash: 1df93b713a653079d2e8c007e9a6a14ff89afa6c3e2f5056b0e9bcd35b9e1a41

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityRockland Trust Company

Victim entityRockland Trust Company

Incidentdiscovered May 16, 2024

Stated responseVendor assessed the information that was disclosed

ComplianceME AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov