HackingVulnerability ExploitData ExfiltratedCustomer Data InvolvedSupply Chain (3P Vendor)IDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTMediumContained
Overby-Seawell Company
bd_d99714d71dcc32ec · schema v1 · pii pii-v1
Full breach record for Overby-Seawell Company →Fulton Bank notified the New Hampshire Attorney General of a cybersecurity incident involving third-party vendor Overby-Seawell Company (OSC). OSC experienced unauthorized access to its servers beginning May 26, 2022, and discovered suspicious activity on July 5, 2022. The breach compromised customer data including names, SSNs, and loan details for 12 New Hampshire residents. OSC notified Fulton Bank on August 11, 2022, and began mailing notifications on August 30, 2022, offering 24 months of credit monitoring.
This filing is one of 4 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (3) · sorted by filing gap
- bd_67031eb717a26f3cDelaware State AGfiled 2022-08-30Verified
- bd_939f65abcb109caaMaine State AGfiled 2022-09-09(10d gap)Candidate
- bd_56b8b28ee38699dbNew Hampshire State AGfiled 2022-11-01(63d gap)Verified
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/fulton-bank-20220830.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Aug 30, 2022
- Raw hash
- 14127c39df51b1ed590d696c8437868eaed538f2335d97cb03ca22382dc3ebf8
Reporting entity
- Name
- Fulton Bank, National Associationnorm: fulton bank national
Victim entity
- Name
- Overby-Seawell Companynorm: overby seawell
Incident
- Discovered
- Jul 5, 2022
- Materiality determined
- —
- Notification sent
- Aug 30, 2022
- Affected individuals
- 12
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
- Threat actor
- ExternalFinancial
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 8 weeks(56 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.