JPMorgan Chase Bank, Dearborn
bd_efe031254bd5408d · schema v1 · pii pii-v1
Full breach record for JPMorgan Chase Bank, Dearborn →A software issue in a vendor-provided system for JPMorgan Chase's Benefit Payment Services product allowed three authorized users (employees of JPMC clients or their benefit administrators) to access and download reports containing personal and financial information of retirement plan participants they were not entitled to see. The unauthorized access occurred on various dates between August 26, 2021, and February 23, 2024. The issue was discovered on February 26, 2024. The exposed data included names, Social Security numbers, mailing addresses, payment amounts, and bank account information.
Linked disclosures
Why this link?Regulatory filings (3) · sorted by filing gap
- bd_d01cecde11f4e3e7Oregon State AGfiled 2024-05-02(3d gap)Verified
- bd_73b14aaa9ac08d8aIndiana State AGfiled 2024-04-18(11d gap)Candidate
- bd_8d03645db4f594c4Washington State AGfiled 2024-04-18(11d gap)Verified
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/389144e8-425a-471b-9879-f5fcd7f16b96.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Apr 29, 2024
- Raw hash
- 3fc571e671e9e9dda69f0a1ce1bcfd081f35e59f37635642f5d0f6b94d09640b
Reporting entity
- Name
- JPMorgan Chase Bank, Dearbornnorm: jpmorgan chase bank dearborn
Victim entity
- Name
- JPMorgan Chase Bank, Dearbornnorm: jpmorgan chase bank dearborn
Incident
- Discovered
- Feb 26, 2024
- Materiality determined
- —
- Notification sent
- Apr 18, 2024
- Affected individuals
- 1,683
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTFINANCIAL
- Attack vector
- Misconfiguration
- Threat actor
- Partner
Compliance
- Time to disclose
- 9 weeks(63 days from discovery to filing)
- Compliance flags
- ME AG >30d · 63d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Feb 26, 2024→ Filed with AG: Apr 29, 202463d 30 days (soft) ME AG >30d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.