HackingFinancial ServicesFinanceCapture Stored DataData ExfiltratedCustomer Data InvolvedPIIIdentity (basic)Financial accountLowContained

Heritage Bank

bd_e1cd1c49a48399f3 · schema v1 · pii pii-v2

Severity

Low

Discovered

Mar 2, 2026

Filed

Apr 23, 2026

To disclose

7 weeks

Affected

448state residents only

Linked

6 filings

Confidence

69%

Full breach record for Heritage Bank →2 incidents on file

Heritage Bank notified Montana residents of a cybersecurity incident occurring on or about March 1-2, 2026. Unauthorized actors accessed the network and copied files containing customer PII and financial account data. The bank engaged third-party investigators, secured the network, and implemented additional technical safeguards. Affected individuals were offered complimentary credit monitoring and identity protection services via Cyberscout (a TransUnion company). Notification was sent on April 23, 2026.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 1 days

discovery → filing · 7 weeks / 52 days

Mar 1, 2026

Begins

Mar 2, 2026

Discovered

Apr 23, 2026

Filed

vs. sector median

1 wks faster

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Nebraska State AGbd_5222b47f23069b6b2026-04-23Verified
California State AGbd_9d96d135619a0e672026-04-23Candidate
Washington State AGbd_c30b25aeaba9958b2026-04-23Verified
Texas State AGbd_b598d849687772682026-04-24 · +1dVerified

Show 1 more filing ↓up to 5d gap

Oregon State AGbd_bbd412e59f5a3d292026-04-28 · +5dVerified

Name: Heritage Bank
norm: heritage bank

Name: Heritage Bank
norm: heritage bank
Industry: Financial Servicesllm

Discovered: Mar 2, 2026
Breach occurred: Mar 1, 2026
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Apr 23, 2026
Affected individuals: 448state-resident count only
Data types: PIIIdentity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1119 Automated CollectionT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial

During the incident: Isolated and secured our network
Engaged third-party specialists to assist us with investigating the nature and scope of the activity
Reviewed the files that left the network to identify the data contained therein and to whom it related
Offering you months of complimentary credit monitoring and identity protection services
Changes made: Implemented additional technical safeguards to further enhance the security of information in our possession and to prevent similar incidents from happening in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(52 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Nebraska State AGApr 23 · first

California State AGApr 23 · first

Washington State AGApr 23 · first

Montana State AGApr 23 · first · this page

Texas State AG+1d

Oregon State AG+5d

Pattern: first filing Apr 23 (NE), last Apr 28 (OR) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/2026/09/Consumer-notification-letter-22.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 23, 2026
Raw hash: beaa21635a1acf098a7be316fb829e285685b14a5c5b12e509af40c2295cdc8a

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityHeritage Bank

Victim entityHeritage Bank

Incidentdiscovered Mar 2, 2026

Stated responseIsolated and secured our network

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov