HackingFinancial ServicesFinanceStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Financial accountLowContained

Orange Bank &Trust Company

bd_f675da0bdbc6db63 · schema v1 · pii pii-v2

Severity

Low

Discovered

—

Filed

Sep 1, 2026

To disclose

—

Affected

Not disclosed

Confidence

70%

Full breach record for Orange Bank &Trust Company →

Orange Bank & Trust Company notified customers that a third-party vendor, Mercadien, P.C. CPAs, experienced a data security incident involving unauthorized access to Box.com files between September 17, 2025, and October 8, 2025. The incident affected customer information, including full names and potentially financial account data. OB&T engaged third-party experts, reset credentials, and offered credit monitoring. No evidence of misuse was found.

J jump to incidentP pin to compareR raw source

Incident timeline

Sep 17, 2025

Begins

Sep 1, 2026

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Orange Bank &Trust Company
norm: orange bank

Name: Orange Bank &Trust Company
norm: orange bank
Industry: Financial Servicesllm

Discovered: —
Breach occurred: Sep 17, 2025 – Oct 8, 2025
Materiality determined: —
Notification sent: Sep 2, 2026
Affected individuals: Not disclosed
Data types: Identity (basic)Financial account
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Third party: via Mercadien, P.C. CPAs
Initial access: trusted_relationship

During the incident: Ensured Mercadien launched a comprehensive investigation
Resetting credentials
Replacing firewall devices
Performing additional and continued scans of the infrastructure devices and end points
Engaged several third-party experts to assist with this matter
Offering complimentary credit monitoring services
Changes made: Resetting credentials
Replacing firewall devices
Performing additional and continued scans of the infrastructure devices and end points
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.mass.gov/doc/2026-1486-orange-bank-trust-company/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 1, 2026
Raw hash: cba6a9ca22b3c0e663c638a95a18ff0528f2c90b56bc5c0d800ca51599198c84

Reporting entityOrange Bank &Trust Company

Victim entityOrange Bank &Trust Company

IncidentThird-Party / Supply Chain

Stated responseEnsured Mercadien launched a comprehensive investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancewww.mass.gov