MisuseFinancial ServicesFinancePrivilege AbuseEmployee Data InvolvedIdentity (basic)Government IDMediumResolved

Wells Fargo Bank, National Association

bd_e72f782894abe4a2 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 12, 2022

Filed

Mar 24, 2023

To disclose

32 weeks

Affected

1state residents only

Linked

3 filings

Confidence

65%

Full breach record for Wells Fargo Bank, National Association →90 incidents on file

Wells Fargo Bank, N.A. notified Montana residents that an employee viewed their personal information (name, SSN, driver's license) without a business need on August 12, 2022. The bank investigated, took action against the employee, and offered two years of Experian IdentityWorks monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 32 weeks / 224 days

Aug 12, 2022

Begins

Aug 12, 2022

Discovered

Mar 24, 2023

Filed

vs. sector median

+23 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_6283125004dab8bd2023-03-20 · +4dVerified
Massachusetts State AGbd_75e6e1e0367ed8452023-05-10 · +47dCandidate

Name: Wells Fargo Bank, National Association
norm: wells fargo bank national

Name: Wells Fargo Bank, National Association
norm: wells fargo bank national
Industry: Financial Servicesllm

Discovered: Aug 12, 2022
Breach occurred: Aug 12, 2022
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 25, 2023
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Insider
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: Internal
Initial access: insider_action

During the incident: Took appropriate actions with respect to the employee in accordance with our policies and procedures
Began internal investigation to identify the information impacted
Offering complimentary two-year subscription to Experian IdentityWorks
Changes made: Taking measures to monitor your account(s) for suspicious events or changes
Continually review our security measures to reduce the likelihood of this happening in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 32 weeks(224 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 2 states

View merged incident ↗

Massachusetts State AGMar 20 · first

Montana State AG+4d · this page

Massachusetts State AG+51d

Pattern: first filing Mar 20 (MA), last May 10 (MA) — a 51-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-133.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 24, 2023
Raw hash: 8c42c2403d69858bdac8eb34dd741611e06d6be46966d57a6d9fcf53f7baebe7

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityWells Fargo Bank, National Association

Victim entityWells Fargo Bank, National Association

Incidentdiscovered Aug 12, 2022

Stated responseTook appropriate actions with respect to the employee in accordance with our policies and procedures

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov