Social EngineeringFinancial ServicesFinancePhishingCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

Bankers Cooperative Group, Inc.

bd_c8f1f69c62db91e7 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 13, 2024

Filed

Jan 30, 2025

To disclose

24 weeks

Affected

1state residents only

Linked

2 filings

Confidence

67%

Full breach record for Bankers Cooperative Group, Inc. →3 incidents on file

Bankers Cooperative Group, Inc. (BCG) notified the Maryland AG of a security incident affecting one Maryland resident. BCG identified suspicious activity on an employee email account on August 13, 2024, likely due to phishing. Impacted data included name, address, DOB, SSN, and health insurance info. BCG disabled the account, engaged forensic specialists, reset passwords, enabled MFA, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Maryland clock✗ MD AG >90d24 weeks discovery → filing

Incident timeline

discovery → filing · 24 weeks / 170 days

Aug 13, 2024

Discovered

Jan 30, 2025

Filed

vs. sector median

+15 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Nebraska State AGbd_7d9081e30aa892eb2025-01-30Verified

Name: CLARK HILL PLC
norm: clark hill

Name: Bankers Cooperative Group, Inc.
norm: bankers cooperative
Industry: Financial Servicesllm

Discovered: Aug 13, 2024
Materiality determined: —
Notification sent: Jan 30, 2025
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Date of birth
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing Link
Threat actor: ExternalFinancial
Initial access: phishing_link

During the incident: Implemented its incident response protocols
Disabled the email account
Began an internal investigation
Engaged external computer forensic specialists to assist with determining what occurred
Reset passwords
Retrained all employees on recognizing and responding to suspicious emails
Offered 12 months of credit monitoring and identity protection services through Experian at no cost
Changes made: Email accounts have multifactor authentication enabled
All employees are required to take cybersecurity training on a yearly basis
Additional security features have been enabled to further enhance the security of BCG’s systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 24 weeks(170 days from discovery to filing)
Compliance flags: MD AG >90d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Nebraska State AGJan 30 · first

Maryland State AGJan 30 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.maryland.gov/resources-info/SBN%20Documents/2025/ITU-376272.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 30, 2025
Raw hash: b64790c6782570680f8cf9e207b97a55040a3117851cfbd371addd01683b4fd0

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityCLARK HILL PLC

Victim entityBankers Cooperative Group, Inc.

Incidentdiscovered Aug 13, 2024

Stated responseImplemented its incident response protocols

ComplianceMD AG >90d

Extraction provenanceno artifact recorded

Source provenanceoag.maryland.gov