HackingFinancial ServicesFinanceVulnerability ExploitCustomer Data InvolvedIdentity (basic)Financial accountFinancial credentialsLowResolved

Mortgage Bankers Association

bd_e09e171be1b5be9f · schema v1 · pii pii-v1

Severity

Low

Discovered

Jan 7, 2021

Filed

Feb 8, 2021

To disclose

5 weeks

Affected · nationwide

7713 in this filing

Linked

5 filings

Confidence

50%

Full breach record for Mortgage Bankers Association →

Mortgage Bankers Association (MBA) experienced a data breach where malicious code was injected into its store website. This resulted in the compromise of customers' names and financial account information, including credit/debit card numbers with their security codes.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Jan 7, 2021 → Filed with AG Feb 8, 202132d ⏱ ME AG >30d5 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 156 days

discovery → filing · 5 weeks / 32 days

Aug 4, 2020

Begins

Jan 7, 2021

Discovered

Feb 8, 2021

Filed

vs. sector median

4 wks faster

This filing is one of 5 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Massachusetts State AGbd_2552b4e51ba034352021-02-08Verified
Montana State AGbd_9a9e7516f8cea44b2021-02-08Verified
Indiana State AGbd_aa80b1f4ec1ddadb2021-02-08Verified
New Hampshire State AGbd_cb818b3048b382102021-02-23 · +15dVerified

Name: Mortgage Bankers Association
norm: mortgage bankers

Name: Mortgage Bankers Association
norm: mortgage bankers
Industry: Financial Servicesllm

Discovered: Jan 7, 2021
Breach occurred: Aug 4, 2020 – Sep 4, 2020
Undetected for: 156 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 8, 2021
Affected individuals: 771state + nationwide
Data types: Identity (basic)Financial accountFinancial credentials
Data elements: Financial account number
Attack vector: Unauthorized Access
Threat actor: ExternalFinancial

Time to disclose: 5 weeks(32 days from discovery to filing)
Compliance flags: ME AG >30d · 32d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Jan 7, 2021
→ Filed with AG: Feb 8, 2021
32d 30 days (soft) ME AG >30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Jan 7, 2021 → Filed with AG: Feb 8, 2021	32d	30 days (soft)	ME AG >30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Massachusetts State AGFeb 8 · first

Montana State AGFeb 8 · first

Indiana State AGFeb 8 · first

Maine State AGFeb 8 · first · this page

New Hampshire State AG+15d

Pattern: first filing Feb 8 (MA), last Feb 23 (NH) — a 15-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/92751411-f924-4267-8bd8-7c589707fc73.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 8, 2021
Raw hash: 1c742154cb227eb64ce87d99c9d537aaeaf7b28a9ecb9b8eecd2da00fc453224

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityMortgage Bankers Association

Victim entityMortgage Bankers Association

Incidentdiscovered Jan 7, 2021

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov