HackingFinancial ServicesFinanceVulnerability ExploitSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Government IDMediumContained

Happen Bank, formerly LendingClub

bd_cfc356600c75179b · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 12, 2023

Filed

Oct 6, 2023

To disclose

24 days

Affected

12state residents only

Confidence

67%

Full breach record for Happen Bank, formerly LendingClub →

LendingClub Bank notified NH AG of a third-party vendor (Darling Consulting Group) breach. An unauthorized individual exploited a vulnerability in DCG's file transfer system on or around Sept 12, 2023, accessing customer PII (names, SSNs, DOBs, driver's licenses). 12 NH residents affected. LendingClub initiated investigation, applied procedural changes, and offered 2 years credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 24 days

Sep 12, 2023

Discovered

Oct 6, 2023

Filed

vs. sector median

5 wks faster

Part of Darling Consulting Group supply-chain incident (2023) — a supply-chain cascade affecting multiple organizations.View cascade →

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed12 affectedView incident

Name: Cooley LLP
norm: cooley

Name: Happen Bank, formerly LendingClub
norm: happen bank formerly lendingclub
Domain: happen.com
Industry: Financial Servicesllm

Discovered: Sep 12, 2023
Materiality determined: —
Notification sent: Sep 28, 2023
Affected individuals: 12state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: External
Regulator citations: Notified New Hampshire Attorney General's Office
Initial access: exploit_public_facing

During the incident: Initiating an investigation into this incident
Working with DCG to gain more information about their investigation of and response to this incident
Made procedural changes designed to help prevent this type of incident from reoccurring in the future
DCG has applied a patch that addresses the vulnerability exploited in the file system software
DCG has notified law enforcement and will assist them in their investigation
Offering two years of complimentary identity protection services from a leading identity monitoring services company
Changes made: Made procedural changes designed to help prevent this type of incident from reoccurring in the future
DCG has applied a patch that addresses the vulnerability exploited in the file system software
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 24 days(24 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/lendingclub-bank-national-association-20231006.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 6, 2023
Raw hash: be4b69dc4d3a9da98a2d44f061abfd9ff04524f9bf546e329f3bfebec91ffadd

Reporting entityCooley LLP

Victim entityHappen Bank, formerly LendingClub

Incidentdiscovered Sep 12, 2023

Stated responseInitiating an investigation into this incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov