Sunflower Bank, National Association

Sunflower Bank, N.A. notified customers of a security incident involving a vulnerability in Progress Software's MOVEit file transfer software. The bank was notified of the vulnerability on May 31, 2023. The incident potentially exposed first and last names and financial transaction information. The bank engaged forensic experts, applied patches, and offered credit monitoring.

Sunflower Bank, N.A. filed a supplemental data security incident notice with the New Hampshire Attorney General regarding a MOVEit zero-day vulnerability exploit. The bank notified 23 New Hampshire residents starting August 14, 2023. The incident involved unauthorized access via a third-party software vulnerability, resulting in the exfiltration of customer data. The bank is offering credit monitoring services to affected individuals.

Sunflower Bank, N.A. was notified on or about May 31, 2023 by Progress Software Corporation of a vulnerability in MOVEit file transfer software, which the bank used for secure file transfers. The bank's MOVEit server was segmented from core systems. Potentially impacted data included names, and financial transaction-related information. The bank engaged outside experts, applied all available fixes, and offered affected individuals Experian credit monitoring.

Sunflower Bank, N.A. notified the NH AG of a data incident involving the MOVEit software zero-day vulnerability. The bank received notice from vendor Progress Software on May 31, 2023. An unauthorized party likely downloaded files from the bank's segmented MOVEit server. 23 New Hampshire residents were affected. The bank engaged forensic experts, applied vendor fixes, and mailed notices offering credit monitoring.

FirstSun Capital Bancorp reported that its subsidiary, Sunflower Bank, N.A., was impacted by a zero-day vulnerability in Progress Software's MOVEit file transfer software. An unauthorized party likely downloaded files containing PII from the MOVEit server. The bank engaged forensic experts and applied vendor patches. The incident is ongoing with no material business interruption reported.