HackingFinancial ServicesFinanceVulnerability ExploitZero-DaySupply Chain (3P Vendor)Customer Data InvolvedPIIIdentity (basic)MediumContained

Clearwater Federal Credit Union

bd_f8736ee041f448ed · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 14, 2023

Filed

Jun 30, 2023

To disclose

16 days

Affected

22,322state residents only

Linked

6 filings

Confidence

65%

Full breach record for Clearwater Federal Credit Union →

Clearwater Credit Union notified members of a third-party vendor breach involving MOVEit file transfer software. Unauthorized parties exploited a zero-day vulnerability to access files between May 30-31, 2023. Personal information was exposed. Clearwater offered one year of Experian IdentityWorks credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 15 days

discovery → filing · 16 days

May 30, 2023

Begins

Jun 14, 2023

Discovered

Jun 30, 2023

Filed

vs. sector median

7 wks faster

This filing is one of 6 about the same incident.View merged incident

Part of Progress Software Corporation supply-chain incident (2023) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Washington State AGbd_88b5087a46ccb0e92023-06-30Candidate
Oregon State AGbd_9b9aae1a4da3f1002023-06-30Verified
Vermont State AGbd_ab3120d865717a202023-06-30Verified
Massachusetts State AGbd_cb1f9edacc66de5d2023-06-30Verified

Show 1 more filing ↓

Maine State AGbd_dce4886072253a032023-06-30Verified

Name: Clearwater Federal Credit Union
norm: clearwater federal credit union

Name: Clearwater Federal Credit Union
norm: clearwater federal credit union
Industry: Financial Servicesllm

Discovered: Jun 14, 2023
Breach occurred: May 30, 2023 – May 31, 2023
Undetected for: 15 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 30, 2023
Affected individuals: 22,322state-resident count only
Data types: PIIIdentity (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Working closely with vendor to secure members' information
Offering complimentary one-year membership to Experian IdentityWorks Credit 3B
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 days(16 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Washington State AGJun 30 · first

Oregon State AGJun 30 · first

Vermont State AGJun 30 · first

Massachusetts State AGJun 30 · first

Maine State AGJun 30 · first

Montana State AGJun 30 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-384.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 30, 2023
Raw hash: 484e536ac3a8febda3fa37cf6f72614ea49ec71999d8905ac8d6e1960821ca9a

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityClearwater Federal Credit Union

Victim entityClearwater Federal Credit Union

Incidentdiscovered Jun 14, 2023

Stated responseWorking closely with vendor to secure members' information

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov