FIDELITY NATIONAL INFORMATION SERVICES, INC.

FIS reported a data security incident involving its third-party vendor Progress Software's MOVEit Transfer tool. A zero-day vulnerability allowed an unauthorized third party to access files transferred from Webster Bank's client, the New Bedford Retirement Board. The incident affected 9 New Hampshire residents, exposing names and financial account/routing numbers. FIS disabled the tool, patched systems, and engaged law enforcement and forensic experts.

Fidelity National Information Services, Inc. reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2023-11-20. 1,417 Massachusetts residents were affected. The report records the breach type as electronic.

Fidelity National Information Services (FIS) disclosed a data security incident involving a third-party service provider using Progress Software's MOVEit Transfer tool. On May 31, 2023, a previously unknown vulnerability (zero-day) in MOVEit was reported. An unauthorized third party accessed files containing personal information (name, financial account numbers, routing numbers, and paycheck amounts) of individuals conducting ACH transactions or receiving payroll via Republic Bank. FIS suspended the tool, patched the vulnerability, engaged forensics, and offered 12 months of identity monitoring to affected individuals.

Fidelity National Information Services, Inc. reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2023-11-09. 168 Massachusetts residents were affected. The report records the breach type as electronic.

Auto Club Trust, a financial services entity, reported an external system breach (hacking) occurring on May 27, 2023, discovered on August 8, 2023. The incident affected 46,033 individuals nationwide, including 24 Maine residents. Acquired data included names and financial account or credit/debit card numbers (with security codes/PINs). Fidelity National Information Services, Inc. (via outside counsel Morgan, Lewis & Bockius LLP) submitted the notice. Remediation included written notifications and 24 months of credit monitoring/identity theft restoration via ChexSystems.

Fidelity National Information Services, Inc. reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2023-10-06. 71 Massachusetts residents were affected. The report records the breach type as electronic.

FIS and Emerald Financial Services (EFS) disclosed a data security incident involving Progress Software's MOVEit Transfer tool. An unauthorized third party exploited a zero-day vulnerability to exfiltrate files containing personal information of Pathward customers, including names, SSNs, DOBs, driver's license numbers, and card account details. FIS and EFS became aware on July 12, 2023. Notifications were mailed to 15,776 Washington residents between September 26-29, 2023. Two years of credit monitoring were offered.

Fidelity National Information Services, Inc. reported a data breach to the Oregon Attorney General. The breach was reported on 2023-10-04. The breach occurred during 5/27/2023 - 5/31/2023. The breach was discovered on 7/12/2023. 793,626 individuals were affected. Notice was sent on 9/27/2023.

Fidelity National Information Services, Inc. reported a data breach affecting H&R Block Emerald Card customers. A third-party service provider using Progress Software's MOVEit Transfer tool was compromised via a previously unknown vulnerability (zero-day) between May 27 and May 31, 2023. FNS became aware of the unauthorized acquisition on July 12, 2023. Affected data includes names, addresses, SSNs, DOBs, driver's license numbers, email addresses, phone numbers, and card account details. FNS suspended the tool, patched the vulnerability, and offered two years of identity monitoring.

Fidelity National Information Services, Inc. reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2023-10-04. 10,070 Massachusetts residents were affected. The report records the breach type as electronic.

NorthEast Community Bank, via core processor FIS, disclosed a data security incident involving Progress Software's MOVEit Transfer tool. A zero-day vulnerability was exploited between May 31 and June 1, 2023, potentially exposing New Hampshire customers' names, addresses, and debit/ATM card numbers. FIS disabled the tool, patched systems, and engaged forensic experts. Three NH residents were notified on September 26, 2023, and offered two years of credit monitoring.

Wayne Savings Community Bank notified customers of a data security incident involving a third-party vendor's MOVEit Transfer tool. The vendor exploited a previously unknown vulnerability (zero-day) in the software. Personal information including names, addresses, and account numbers was potentially accessed. No evidence of unauthorized use was found. The vendor patched the tool and offered 12 months of identity monitoring.

Fidelity National Information Services, Inc. reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2023-09-19. 383 Massachusetts residents were affected. The report records the breach type as electronic.

Fidelity National Information Services, Inc. reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2023-09-19. 2 Massachusetts residents were affected. The report records the breach type as electronic.

Community Trust Bank, Inc. (CTBI) notified the NH AG of a data incident involving its service provider FIS and third-party vendor Progress Software's MOVEit Transfer. An unauthorized party exploited a zero-day vulnerability to access files containing customer PII (names, SSNs, etc.) on May 29-30, 2023. FIS discovered the breach on August 9, 2023. 6 NH residents are affected. Notifications and credit monitoring were offered.

Fidelity National Information Services, Inc. reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2023-09-08. 10 Massachusetts residents were affected. The report records the breach type as electronic.

Umpqua Bank, via vendor FIS, notified New Hampshire AG of a MOVEit Transfer zero-day exploit (T1190) affecting 50 state residents. Personal info (SSN, name) was accessed. FIS patched the system and notified law enforcement. Umpqua offered 24 months of credit monitoring.

Fidelity National Information Services, Inc. reported a data breach to the Oregon Attorney General. The breach was reported on 2023-08-11. The breach occurred during 5/27/2023 - 5/31/2023. The breach was discovered on 5/31/2023. 429,252 individuals were affected. Notice was sent on 8/11/2023.

Umpqua Bank, a client of FIS, experienced a data breach via a zero-day vulnerability in Progress Software's MOVEit Transfer tool. The incident exposed names and SSNs of 145,274 Washington residents. FIS disabled the tool, patched systems, and engaged forensic experts. Umpqua notified affected individuals and offered 24 months of credit monitoring.

Umpqua Bank notified customers that their names and Social Security numbers were accessed via a third-party vendor's exposure in the global MOVEit Transfer cybersecurity incident. The vendor, which provides technology services to Umpqua, was notified of the vulnerability on May 31, 2023, and of the potential access on June 21, 2023. Umpqua is offering 24 months of identity monitoring.

Community Trust Bank, Inc. notified customers of a data security event involving its service provider, FIS, and MOVEit Transfer software. A zero-day vulnerability in MOVEit was exploited by unauthorized actors between May 30 and July 30, 2023. Personal information was accessed. FIS discovered the access on July 24, 2023. Bank systems were not compromised. Credit monitoring offered.

Fidelity National Information Services, Inc. reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2023-07-21. 338 Massachusetts residents were affected. The report records the breach type as electronic.

Valley Bank notified Montana residents of a data breach involving a third-party service provider's MOVEit system. Unauthorized access occurred between May 27-31, 2023, exploiting a vulnerability in the software. Affected data included names, addresses, SSNs, and loan numbers. The bank offered two years of free credit monitoring via ChexSystems.

Sound Community Bank, a client of vendor FIS, experienced a data breach via a zero-day vulnerability in Progress Software's MOVEit Transfer tool. The CL0P ransomware group exploited the vulnerability to exfiltrate customer data including SSNs and account numbers. FIS disabled the tool and patched it on May 31, 2023. Sound Community Bank was notified on June 13, 2023, and is notifying 13,795 Washington residents, offering 2 years of credit monitoring.

Fidelity National Information Services, Inc. reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2023-07-17. 5 Massachusetts residents were affected. The report records the breach type as electronic.