HackingFinancial ServicesFinanceVulnerability ExploitSupply Chain (3P Vendor)TargetedPIIIdentity (basic)Government IDMediumContained

Flagstar Bank, National Association

bd_cadf86dc7b5d1855 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 22, 2021

Filed

Sep 21, 2022

To disclose

20 months

Affected

25state residents only

Confidence

66%

Full breach record for Flagstar Bank, National Association →7 incidents on file

Flagstar Bank notified Montana residents of a data breach involving its Accellion file-sharing vendor. The vendor's platform vulnerability was exploited by an unauthorized party, potentially exposing personal information. Flagstar took the server offline, engaged forensic experts, notified law enforcement, and offered two years of free identity monitoring via Kroll.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 20 months / 607 days

Jan 22, 2021

Discovered

Sep 21, 2022

Filed

vs. sector median

+78 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed25 affectedView incident

Name: Flagstar Bank, National Association
norm: flagstar bank national

Name: Flagstar Bank, National Association
norm: flagstar bank national
Industry: Financial Servicesllm

Discovered: Jan 22, 2021
Materiality determined: —
Notification sent: Jun 3, 2021
Affected individuals: 25state-resident count only
Data types: PIIIdentity (basic)Government ID
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Took the Accellion server offline and permanently discontinued use of this file sharing platform
Acted immediately to contain the threat
Engaged a team of third-party forensic experts to investigate and determine the full scope of this incident
Notified law enforcement
Changes made: Secured the services of Kroll to provide identity monitoring at no cost to you for two years
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 20 months(607 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-Notification-Letter-603.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 21, 2022
Raw hash: ec6668ee0e2430fadba9de4fd2da9b29bf8db12cb08561c87926c5d116d79925

Reporting entityFlagstar Bank, National Association

Victim entityFlagstar Bank, National Association

Incidentdiscovered Jan 22, 2021

Stated responseTook the Accellion server offline and permanently discontinued use of this file sharing platform

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov