HackingFinancial ServicesFinanceVulnerability ExploitSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedPIIIdentity (basic)Government IDMediumContained

Northfield Bank

bd_d9885b4724d48106 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 4, 2023

Filed

Oct 2, 2023

To disclose

8 weeks

Affected

2state residents only

Linked

7 filings

Confidence

66%

Full breach record for Northfield Bank →

Northfield Bank filed a supplemental notice with the New Hampshire Attorney General regarding a data security event involving a third-party vendor's use of MOVEit Transfer software. The incident occurred between May 27 and May 31, 2023. The bank notified 2 New Hampshire residents. Affected data included personal information potentially including SSNs and government IDs. The bank provided credit monitoring via Kroll and engaged cybersecurity specialists.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 69 days

discovery → filing · 8 weeks / 59 days

May 27, 2023

Begins

Aug 4, 2023

Discovered

Oct 2, 2023

Filed

vs. sector median

on median

This filing is one of 7 filings about the same incident.View merged incident

Part of Progress Software Corporation supply-chain incident (2023) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Indiana State AGbd_2d7bc11eba226abc2023-09-25 · +7dVerified
Vermont State AGbd_d86ff387ddb8a86a2023-09-25 · +7dVerified
Massachusetts State AGbd_05cc028fdb8910792023-09-08 · +24dVerified
New Hampshire State AGbd_9963040c41fa49262023-09-08 · +24dVerified

Show 2 more filings ↓up to 25d gap

Vermont State AGbd_e04b124b7a8d579e2023-09-08 · +24dCandidate
Maine State AGbd_79fd0089944d11242023-09-07 · +25dCandidate

Name: Northfield Bank
norm: northfield bank

Name: Northfield Bank
norm: northfield bank
Industry: Financial Servicesllm

Discovered: Aug 4, 2023
Breach occurred: May 27, 2023 – May 31, 2023
Undetected for: 69 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 7, 2023
Affected individuals: 2state-resident count only
Data types: PIIIdentity (basic)Government ID
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1190 Exploit Public-Facing Application
Threat actor: Partner
Regulator citations: providing notice of this incident to relevant state and federal regulators
Initial access: supply_chain

During the incident: Began mailing notice letters to potentially affected individuals
Investigate, gather as much information from the vendor as possible
Providing individuals whose personal information was potentially impacted by this event access to credit monitoring services for through Kroll at no cost to the individuals
Providing impacted individuals with guidance on how to better protect against identity theft and fraud
Providing notice of this incident to relevant state and federal regulators
Changes made: Vendor mobilized a technical response team to examine the relevant MOVEit Transfer systems
Vendor has also remediated all technical vulnerabilities and patched systems in accordance with the MOVEit software provider’s guidelines
Engaged cyber security specialists to assist us in monitoring their investigation and remediation
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(59 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 5 states

View merged incident ↗

Maine State AGSep 7 · first

Massachusetts State AG+1d

New Hampshire State AG+1d

Vermont State AG+1d

Indiana State AG+18d

Vermont State AG+18d

New Hampshire State AG+25d · this page

Pattern: first filing Sep 7 (ME), last Oct 2 (NH) — a 25-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/northfield-bank-20231002.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 2, 2023
Raw hash: ce1800b77062912c42cce37f0794ce11c3214bf66b6a3a4fd0baf82675add0b0

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityNorthfield Bank

Victim entityNorthfield Bank

Incidentdiscovered Aug 4, 2023

Stated responseBegan mailing notice letters to potentially affected individuals

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov