MalwareFinancial ServicesFinanceRansomwareData EncryptedData DestroyedPIIIdentity (basic)Financial accountLowResolved

ARBOR FINANCIAL CREDIT UNION

bd_f212aa26396295ee · schema v1 · pii pii-v1

Severity

Low

Discovered

May 15, 2020

Filed

Nov 6, 2020

To disclose

25 weeks

Affected

9state residents only

Linked

5 filings

Confidence

63%

Full breach record for ARBOR FINANCIAL CREDIT UNION →

Arbor Financial Credit Union notified Montana residents of a ransomware infection on May 15, 2020, which encrypted files on some servers. The incident was contained, systems restored from backups, and data destroyed by cybersecurity professionals. No evidence of data misuse was found. The credit union offered one year of Experian IdentityWorks credit monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 25 weeks / 175 days

May 15, 2020

Begins

May 15, 2020

Discovered

Nov 6, 2020

Filed

vs. sector median

+16 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Indiana State AGbd_643f9d558070108c2020-11-06Verified
Massachusetts State AGbd_71971fe4fa9af42b2020-11-07 · +1dVerified
Maine State AGbd_730e1be8fa55ffe72020-11-07 · +1dVerified by operator
New Hampshire State AGbd_d8d6af095db8b6972020-11-12 · +6dVerified

Name: ARBOR FINANCIAL CREDIT UNION
norm: arbor financial credit union

Name: ARBOR FINANCIAL CREDIT UNION
norm: arbor financial credit union
Industry: Financial Servicesllm

Discovered: May 15, 2020
Breach occurred: May 15, 2020
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 9state-resident count only
Data types: PIIIdentity (basic)Financial account
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1486 Data Encrypted for Impact
Threat actor: ExternalFinancial

During the incident: Contained the threat
Commenced a thorough investigation
Working very closely with external cybersecurity professionals
Working closely with law enforcement
Restored information and systems from backups
Offering a complimentary one-year membership of Experian IdentityWorks
Changes made: Fortify security measures to help prevent future cyber security threats
Continually evaluate and modify practices and internal controls to enhance the security and privacy of your information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 25 weeks(175 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Indiana State AGNov 6 · first

Montana State AGNov 6 · first · this page

Massachusetts State AG+1d

Maine State AG+1d

New Hampshire State AG+6d

Pattern: first filing Nov 6 (IN), last Nov 12 (NH) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/arbSamp.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 6, 2020
Raw hash: a3bbdef1643f1d43f3d3ea8eb72799525ddffc9c786da499efe615c7099be7aa

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityARBOR FINANCIAL CREDIT UNION

Victim entityARBOR FINANCIAL CREDIT UNION

Incidentdiscovered May 15, 2020

Stated responseContained the threat

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov