HackingVulnerability ExploitSupply Chain (3P Vendor)Customer Data InvolvedZero-DayIDENTITY_BASICIDENTITY_GOVERNMENTMediumContained
Umpqua Bank
bd_d3b7a25fe28a7b9b · schema v1 · pii pii-v1
Full breach record for Umpqua Bank →Umpqua Bank notified California residents that their names and Social Security numbers were accessed due to a third-party vendor's exposure in the global MOVEit Transfer cybersecurity incident. The vendor uses Progress Software's MOVEit Transfer tool, which had a previously unknown vulnerability reported on May 31, 2023. The breach date is listed as May 27, 2023. Umpqua was notified by the vendor on June 21, 2023. No banking information was involved. The bank is offering 24 months of identity monitoring.
California clockDiscovered Jun 21, 2023 → Notified Jun 22, 20231d ✓ CA 60-day OK7 weeks discovery → filing
This filing is one of 3 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (2) · sorted by filing gap
- bd_d739cdfb0d8e16a8Maine State AGfiled 2023-08-11Verified
- bd_4d92681387db7779SEC 8-Kfiled 2023-06-27(45d gap)Candidate
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-571656
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Aug 11, 2023
- Raw hash
- 5138778c0907c7f90522ed952c6d88d094074c41bc54f09d09d42486f50dac20
Reporting entity
- Name
- FIDELITY NATIONAL INFORMATION SERVICES, INC.norm: fidelity national information
Victim entity
- Name
- Umpqua Banknorm: umpqua bank
Incident
- Discovered
- Jun 21, 2023
- Materiality determined
- —
- Notification sent
- Jun 22, 2023
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1195 Supply Chain Compromise
- Threat actor
- External
- Initial access
- supply_chain
Compliance
- Time to disclose
- 7 weeks(51 days from discovery to filing)
- Compliance flags
- CA 60-day OK · 1d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Jun 21, 2023→ Notified: Jun 22, 20231d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.