HackingFinancial ServicesFinanceVulnerability ExploitSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Government IDCredentialsMediumContained

Northfield Bank

bd_d86ff387ddb8a86a · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 4, 2023

Filed

Sep 25, 2023

To disclose

7 weeks

Affected

Not disclosed

Linked

7 filings

Confidence

66%

Full breach record for Northfield Bank →

Northfield Bank notified Vermont consumers of a data security event involving its third-party vendor, Progress Software Corporation. The incident, occurring May 27-31, 2023, exploited vulnerabilities in the MOVEit Transfer application. Affected data included names, account numbers, SSNs, and online banking usernames. No passwords were compromised. Northfield Bank engaged cybersecurity specialists and the vendor patched systems. Affected individuals received two years of complimentary identity monitoring through Kroll.

J jump to incidentP pin to compareR raw source

Vermont clock⏱ VT AG >14 bday7 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 69 days

discovery → filing · 7 weeks / 52 days

May 27, 2023

Begins

Aug 4, 2023

Discovered

Sep 25, 2023

Filed

vs. sector median

2 wks faster

This filing is one of 7 about the same incident.View merged incident

Part of Progress Software Corporation supply-chain incident (2023) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Indiana State AGbd_2d7bc11eba226abc2023-09-25Verified
New Hampshire State AGbd_d9885b4724d481062023-10-02 · +7dVerified
Massachusetts State AGbd_05cc028fdb8910792023-09-08 · +17dVerified
New Hampshire State AGbd_9963040c41fa49262023-09-08 · +17dVerified

Show 2 more filings ↓up to 18d gap

Vermont State AGbd_e04b124b7a8d579e2023-09-08 · +17dCandidate
Maine State AGbd_79fd0089944d11242023-09-07 · +18dCandidate

Name: Northfield Bank
norm: northfield bank

Name: Northfield Bank
norm: northfield bank
Industry: Financial Servicesllm

Discovered: Aug 4, 2023
Breach occurred: May 27, 2023 – May 31, 2023
Undetected for: 69 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 25, 2023
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDCredentials
Data elements: Social Security number
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Initial access: supply_chain

During the incident: Began working with our vendor to monitor their investigation and remediation
Engaged cyber security specialists to assist us in monitoring their investigation and remediation
Offering for a period of two years complimentary identity monitoring and restoration services through Kroll
Changes made: Vendor mobilized a technical response team to examine the relevant MOVEit Transfer systems
Vendor remediated all technical vulnerabilities and patched systems in accordance with the MOVEit software provider’s guidelines
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(52 days from discovery to filing)
Compliance flags: VT AG >14 bday
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 5 states

View merged incident ↗

Maine State AGSep 7 · first

Massachusetts State AG+1d

New Hampshire State AG+1d

Vermont State AG+1d

Indiana State AG+18d

Vermont State AG+18d · this page

New Hampshire State AG+25d

Pattern: first filing Sep 7 (ME), last Oct 2 (NH) — a 25-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2023-09-25-northfield-bank-progress-software-moveit-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 25, 2023
Raw hash: 8a6b41d12b96b4ef7c4922f4b804fc742fc6ac238c6c9baa11be09eb88e60460

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityNorthfield Bank

Victim entityNorthfield Bank

Incidentdiscovered Aug 4, 2023

Stated responseBegan working with our vendor to monitor their investigation and remediation

ComplianceVT AG >14 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov