HackingFinancial ServicesFinanceVulnerability ExploitSupply Chain (3P Vendor)TargetedIdentity (basic)Government IDCredentialsMediumContained

Northfield Bank

bd_e04b124b7a8d579e · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 4, 2023

Filed

Sep 8, 2023

To disclose

5 weeks

Affected

Not disclosed

Linked

7 filings

Confidence

66%

Full breach record for Northfield Bank →

Northfield Bank notified consumers of a data security event involving its third-party vendor, Progress Software Corporation. The incident, occurring May 27-31, 2023, exploited vulnerabilities in the MOVEit Transfer application. Affected data included names, account numbers, SSNs, and online banking usernames. No passwords were compromised. Northfield Bank engaged cybersecurity specialists and the vendor patched systems. Affected individuals received two years of complimentary identity monitoring via Kroll.

J jump to incidentP pin to compareR raw source

Vermont clock⏱ VT AG >14 bday5 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 69 days

discovery → filing · 5 weeks / 35 days

May 27, 2023

Begins

Aug 4, 2023

Discovered

Sep 8, 2023

Filed

vs. sector median

4 wks faster

This filing is one of 7 about the same incident.View merged incident

Part of Progress Software Corporation supply-chain incident (2023) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Massachusetts State AGbd_05cc028fdb8910792023-09-08Verified
New Hampshire State AGbd_9963040c41fa49262023-09-08Verified
Maine State AGbd_79fd0089944d11242023-09-07 · +1dCandidate
Indiana State AGbd_2d7bc11eba226abc2023-09-25 · +17dVerified

Show 2 more filings ↓up to 24d gap

Vermont State AGbd_d86ff387ddb8a86a2023-09-25 · +17dVerified
New Hampshire State AGbd_d9885b4724d481062023-10-02 · +24dVerified

Name: Northfield Bank
norm: northfield bank

Name: Northfield Bank
norm: northfield bank
Industry: Financial Servicesllm

Discovered: Aug 4, 2023
Breach occurred: May 27, 2023 – May 31, 2023
Undetected for: 69 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 8, 2023
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDCredentials
Data elements: Social Security number
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Began working with our vendor to monitor their investigation and remediation
Engaged cyber security specialists to assist in monitoring their investigation and remediation
Changes made: Vendor mobilized a technical response team to examine relevant MOVEit Transfer systems
Vendor remediated all technical vulnerabilities and patched systems
Offering complimentary identity monitoring and restoration services through Kroll for a period of two years
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(35 days from discovery to filing)
Compliance flags: VT AG >14 bday
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 5 states

View merged incident ↗

Maine State AGSep 7 · first

Massachusetts State AG+1d

New Hampshire State AG+1d

Vermont State AG+1d · this page

Indiana State AG+18d

Vermont State AG+18d

New Hampshire State AG+25d

Pattern: first filing Sep 7 (ME), last Oct 2 (NH) — a 25-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2023-09-08-northfield-bank-progress-software-moveit-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 8, 2023
Raw hash: 63729f2081fbd9f0260916a67aa18e5ee08c21e32c742356c0765b02a5888415

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityNorthfield Bank

Victim entityNorthfield Bank

Incidentdiscovered Aug 4, 2023

Stated responseBegan working with our vendor to monitor their investigation and remediation

ComplianceVT AG >14 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov