MalwareFinancial ServicesFinanceRansomwareRansom DemandedRansom PaidData ExfiltratedCustomer Data InvolvedGovernment IDIdentity (basic)MediumResolved

Victory Bank of Limerick PA

bd_ee397be5b857ad8d · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Sep 7, 2021

To disclose

—

Affected

5state residents only

Linked

5 filings

Confidence

66%

Full breach record for Victory Bank of Limerick PA →

The Victory Bank of Limerick, PA suffered a ransomware attack in June 2021. Systems were encrypted, and data was restored from backups. The bank negotiated with the threat actor via Coveware and paid a ransom to ensure personal information (SSNs and driver's license numbers) of 5 New Hampshire residents was destroyed and not published. The bank offered two years of credit monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

Jun 1, 2021

Begins

Sep 7, 2021

Filed

This filing is one of 5 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Massachusetts State AGbd_890338ea3beee2752021-09-07Verified
Maine State AGbd_8c058fd050b07b302021-09-07Verified
Indiana State AGbd_ed8a6d67e10cf4ff2021-09-07Verified
Montana State AGbd_9a706995b2568ddf2021-09-03 · +4dCandidate

Name: The Victory Bank of Limerick, PA
norm: the victory bank of limerick

Name: Victory Bank of Limerick PA
norm: victory bank of limerick
Industry: Financial Servicesllm

Discovered: —
Breach occurred: Jun 1, 2021
Materiality determined: —
Notification sent: Sep 5, 2021
Affected individuals: 5state-resident count only
Data types: Government IDIdentity (basic)
Data elements: Social Security numberDate of birth
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified the New Hampshire Office of the Attorney General

During the incident: Retained Stroz Friedberg and the FBI
Retained leading threat actor negotiator Coveware
Restored its systems and data from backups
Engaged in lengthy negotiations with the threat actor
Paid the negotiated ransom amount
Notified law enforcement
Engaged directly with the threat actor
Changes made: Enhancements to its security programs since the incident
Offering each one who resides in New Hampshire two years of credit monitoring
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Montana State AGSep 3 · first

Massachusetts State AG+4d

Maine State AG+4d

Indiana State AG+4d

New Hampshire State AG+4d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/victory-bank-limerick-20210907.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 7, 2021
Raw hash: acdf507012e3fd4e3e58904742949316e35af889c520bbe1fdf0af59b49c1247

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityThe Victory Bank of Limerick, PA

Victim entityVictory Bank of Limerick PA

IncidentRansomware

Stated responseRetained Stroz Friedberg and the FBI

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov