1st Source Bank

The business associate (BA), 1st Source Bank, reported that a software application exposed the protected health information (PHI) of 1,477 individuals. The PHI involved included names, dates of birth, addresses, Social Security numbers, diagnoses, claims and health insurance information, and financial and other treatment information. In response to the breach, the BA implemented additional administrative, technical, and security safeguards to better protect PHI.

Affected (this filing): 1,477

1st Source Bank notified customers that their personal information, including names and Social Security numbers, may have been acquired without authorization due to a critical vulnerability in the MOVEit file transfer software provided by Progress Software. The bank became aware of the alert on June 1, 2023, and patched the system. The breach date listed by the CA AG is May 27, 2023. The bank engaged cybersecurity experts and is offering 12 months of identity monitoring via Kroll.