HackingFinancial ServicesFinanceStolen CredentialsCustomer Data InvolvedTargetedIdentity (basic)CredentialsMediumContained

Members Trust Company

bd_d078623a43760ff3 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 30, 2024

Filed

Nov 19, 2024

To disclose

42 weeks

Affected · nationwide

11,8547 in this filing

Linked

3 filings

Confidence

66%

Full breach record for Members Trust Company →

Members Trust Company, a financial services firm, disclosed that an unauthorized third party gained access to employee email accounts between September 1 and October 17, 2023. The breach was discovered on January 30, 2024, affecting 11,854 individuals, including 7 Maine residents. Personal information, including names and other identifiers, was accessed. The company engaged forensic investigators, secured accounts, and offered one year of Experian IdentityWorks credit monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Jan 30, 2024 → Filed with AG Nov 19, 2024294d ✗ ME AG >90d42 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 151 days

discovery → filing · 42 weeks / 294 days

Sep 1, 2023

Begins

Jan 30, 2024

Discovered

Nov 19, 2024

Filed

vs. sector median

+33 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Montana State AGbd_765041258a2892742024-11-19Candidate
Massachusetts State AGbd_a37e974ec66f53ad2024-11-19Verified

Name: Members Trust Company
norm: members trust

Name: Members Trust Company
norm: members trust
Industry: Financial Servicesllm

Discovered: Jan 30, 2024
Breach occurred: Sep 1, 2023 – Oct 17, 2023
Undetected for: 151 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 19, 2024
Affected individuals: 11,854state + nationwide
Data types: Identity (basic)Credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Initial access: valid_credentials

During the incident: Secured the email accounts from further unauthorized access
Began an internal investigation
Engaged a forensic security firm to further investigate and confirm the security of our email and computer systems
Changes made: Enhancing our technical security measures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 42 weeks(294 days from discovery to filing)
Compliance flags: ME AG >90d · 294dME resident >180d · 294d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Jan 30, 2024
→ Filed with AG: Nov 19, 2024
294d 90 days ME AG >90d
Maine
Discovered: Jan 30, 2024
→ Notified: Nov 19, 2024
294d 180 days ME resident >180d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Jan 30, 2024 → Filed with AG: Nov 19, 2024	294d	90 days	ME AG >90d
Maine	Discovered: Jan 30, 2024 → Notified: Nov 19, 2024	294d	180 days	ME resident >180d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Montana State AGNov 19 · first

Massachusetts State AGNov 19 · first

Maine State AGNov 19 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/4c312791-771d-4009-9c0d-8b2b799ca131.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 19, 2024
Raw hash: f165cb38cbb30bda89b8e6cab40fca7358394103e73c9a902e9ddf6f26907a23

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityMembers Trust Company

Victim entityMembers Trust Company

Incidentdiscovered Jan 30, 2024

Stated responseSecured the email accounts from further unauthorized access

ComplianceME AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov