HackingFinancial ServicesFinanceVulnerability ExploitZero-DayData ExfiltratedCustomer Data InvolvedSupply Chain (3P Vendor)PIIIdentity (basic)LowContained

Sunflower Bank, National Association

bd_ef42af6291b75a20 · schema v1 · pii pii-v1

Severity

Low

Discovered

May 31, 2023

Filed

Aug 15, 2023

To disclose

11 weeks

Affected

23state residents only

Linked

8 filings

Confidence

66%

Full breach record for Sunflower Bank, National Association →

Sunflower Bank, N.A. notified the NH AG of a data incident involving the MOVEit software zero-day vulnerability. The bank received notice from vendor Progress Software on May 31, 2023. An unauthorized party likely downloaded files from the bank's segmented MOVEit server. 23 New Hampshire residents were affected. The bank engaged forensic experts, applied vendor fixes, and mailed notices offering credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 11 weeks / 76 days

May 31, 2023

Discovered

Jul 14, 2023

Scope determined

Aug 15, 2023

Filed

vs. sector median

+2 wks slower

This filing is one of 8 about the same incident.View merged incident

Part of Progress Software Corporation supply-chain incident (2023) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

California State AGbd_895de35e1cea98f02023-08-15Verified
Montana State AGbd_b791064e55b0bfd82023-08-15Verified
Indiana State AGbd_791c96ad5aceed032023-08-14 · +1dVerified
Massachusetts State AGbd_57054109e6719b1e2023-08-22 · +7dVerified

Show 3 more filings ↓up to 50d gap

SEC 8-Kbd_d36ee2ad177829e82023-07-14 · +32dVerified
New Hampshire State AGbd_46ae3c2793a327922023-10-02 · +48dVerified
California State AGbd_fea17e438a10a5c62023-10-04 · +50dVerified

Name: Sunflower Bank, National Association
norm: sunflower bank national

Name: Sunflower Bank, National Association
norm: sunflower bank national
Industry: Financial Servicesllm

Discovered: May 31, 2023
Materiality determined: Jul 14, 2023
Notification sent: Aug 14, 2023
Affected individuals: 23state-resident count only
Data types: PIIIdentity (basic)
Attack vector: Misconfiguration
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General
Initial access: exploit_public_facing

During the incident: Enacted response protocols to address the zero-day vulnerability
Retained a third-party forensic expert
Launched a comprehensive investigation
Implemented all fixes to the software that Progress Software has issued
Conducted a thorough review of the impacted data
Posted a public notice of the event on the main page of its website
Issued consumer notices via U.S. Mail
Offered complimentary membership to Experian’s IdentityWorks product
Changes made: Implemented all fixes to the software that Progress Software has issued
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 weeks(76 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 5 states

View merged incident ↗

SEC 8-KJul 14 · first

Indiana State AG+31d

California State AG+32d

Montana State AG+32d

New Hampshire State AG+32d · this page

Massachusetts State AG+39d

New Hampshire State AG+80d

California State AG+82d

Pattern: first filing Jul 14, last Oct 4 (CA) — a 82-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/sunflower-bank-20230815.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 15, 2023
Raw hash: ee04de51fa3a0476726b0e7dc889639d623d6ee263517f96a5d20b419aecc68f

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entitySunflower Bank, National Association

Victim entitySunflower Bank, National Association

Incidentdiscovered May 31, 2023

Stated responseEnacted response protocols to address the zero-day vulnerability

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov