MisuseFinancial ServicesFinancePrivilege AbuseCustomer Data InvolvedFinancial accountIdentity (basic)LowResolved

Enterprise Bank

bd_f823ce016e2f7045 · schema v1 · pii pii-v1

Severity

Low

Discovered

Oct 31, 2014

Filed

Dec 29, 2014

To disclose

8 weeks

Affected · nationwide

58241 in this filing

Linked

2 filings

Confidence

66%

Full breach record for Enterprise Bank →4 incidents on file

Enterprise Bank reported unauthorized access to its Investment Advisory Trust client portal. An existing client accessed the portal on October 30, 2014, and viewed account numbers, names, and market values for approximately 582 accounts, including 41 New Hampshire residents. No SSNs or passwords were exposed. Access was disabled immediately upon notification on October 31, 2014. The bank notified regulators and affected customers, offering one year of identity theft protection.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 1 days

discovery → filing · 8 weeks / 59 days

Oct 30, 2014

Begins

Oct 31, 2014

Discovered

Dec 29, 2014

Filed

vs. sector median

on median

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_8e2a0504d3547fe12014-12-30 · +1dVerified

Name: Enterprise Bank
norm: enterprise bank
Domain: www.EnterpriseBanking.com

Name: Enterprise Bank
norm: enterprise bank
Domain: www.EnterpriseBanking.com
Industry: Financial Servicesllm

Discovered: Oct 31, 2014
Breach occurred: Oct 30, 2014
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Dec 29, 2014
Affected individuals: 582state + nationwide
Data types: Financial accountIdentity (basic)
Attack vector: Unknown
Threat actor: Internal
Regulator citations: Notified the Massachusetts and New Hampshire Division of BanksNotified the Massachusetts, New Hampshire, Connecticut, New York and Vermont Attorney GeneralsNotified the Massachusetts Office of Consumer Affairs and Business RegulationNotified the New York Division of State PoliceNotified the New York State Division of Consumer ProtectionNotified the Federal Reserve Bank of BostonNotified the Federal Deposit Insurance Corporation
Initial access: valid_credentials

During the incident: Disabled access to the Trust client portal immediately following receipt of notification
Worked with service providers to determine how the unauthorized access was granted
Removed the specific client's access
Verified all client portal access
Re-activated client access to the Trust client portal on November 3, 2014
Spoken with the client who had access to the portal
Notified the Massachusetts and New Hampshire Division of Banks
Notified the Massachusetts, New Hampshire, Connecticut, New York and Vermont Attorney Generals
Notified the Massachusetts Office of Consumer Affairs and Business Regulation
Notified the New York Division of State Police
Notified the New York State Division of Consumer Protection
Notified the Federal Reserve Bank of Boston
Notified the Federal Deposit Insurance Corporation
Mailed formal notification to all customers affected on December 29, 2014
Informed the three national consumer reporting agencies of the incident
Provided a one year subscription to an Identity Theft product from Deluxe free of charge
Changes made: Modified default access codes
Increased audit logging of user and client activity
Enhanced management reporting of user access activity and settings
Reviewing and assessing procedures that will help prevent the occurrence of this type of unauthorized access in the future
Additional training for employees
Enhanced Investment Advisory procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(59 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

New Hampshire State AGDec 29 · first · this page

Massachusetts State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/enterprise-bank-20141229.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 29, 2014
Raw hash: 08da00a95446b7afe92cc5f0faf04c4b78d28b96fe2985801ae094c064fc0e2c

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityEnterprise Bank

Victim entityEnterprise Bank

Incidentdiscovered Oct 31, 2014

Stated responseDisabled access to the Trust client portal immediately following receipt of notification

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov