Clustered 10 filings across 8 jurisdictions · filing window Jul 10, 2023 → Jul 27, 2023. View entity profile → Other incidents for this victim →
incident inc_90c0410ce6e34932 · merge_method deterministic · confidence 100%
Discovered → first regulatory filing
Range of discovered_at dates across filings
Discovery to SEC materiality determination
Materiality determination to SEC 8-K filing
Time between earliest and latest filing
Not recorded for this incident
Leak precedence — no leak-site claim in this cluster.
PII · Identity (basic)
CA FEDERAL ME MT NH OR VT WA
SEC 8-K · State AG
per-filing reported counts
State AGs report only their own residents; bars show per-filing counts.
Earliest sighting first · deep chronology in Litigation Timeline
10 filings across 8 jurisdictions · Jul 10, 2023 – Jul 27, 2023 · 4 milestones
May 27, 2023
When the intrusion reportedly occurred, per the linked filings
May 31, 2023
Reported by SEC 8-K filing
Jun 1, 2023
Reported by VERMONT AG, CALIFORNIA AG, MAINE AG, OREGON AG, WASHINGTON AG, NEW HAMPSHIRE AG filings
Jul 10, 2023
Registrant determined the incident material — starts the SEC 4-business-day clock
1st Source Bank, a subsidiary of 1st Source Corp, disclosed a cybersecurity incident stemming from a vulnerability in Progress Software's MOVEit file transfer software. An unauthorized third party gained access to sensitive client data, including PII. The company patched the software, engaged forensic experts, and is notifying affected clients, offering credit monitoring. The investigation is ongoing.
About this clustering
DisclosureLens links filings into incidents through layered matchers: deterministic rules (same source document, multistate filings of one breach, tight-window same-victim pairs), a weighted-similarity scorer for cross-source candidates, and an operator review queue for everything uncertain. Each link records its own method and confidence — shown per filing in the timeline below. The system defaults to NOT merging when uncertain, because a false merge (collapsing two unrelated breaches) is more harmful than a false split (showing related filings separately); uncertain pairs route to human review instead of auto-merging. Filing summaries shown in the timeline are AI-generated extracts — verify each against its linked source.
1st Source Bank notified Vermont consumers of a data breach linked to the MOVEit file transfer software vulnerability. The incident, discovered June 1, 2023, potentially exposed names, SSNs, driver's license numbers, and dates of birth. The bank patched its system, engaged forensic experts, and offered 12 months of identity monitoring through Kroll.
1st Source Bank disclosed a data breach affecting customer information due to a vulnerability in the MOVEit file transfer software provided by Progress Software. The bank became aware of the vulnerability alert on June 1, 2023, and determined that data may have been acquired without authorization on June 24, 2023. Affected data includes names, Social Security numbers, driver's license numbers, and dates of birth. The bank patched the system, engaged cybersecurity experts, and offered 12 months of identity monitoring through Kroll.
1st Source Bank reported a data breach to the Montana Attorney General. The breach was reported on 2023-07-19. The breach occurred on 6/1/2023. 187 Montana residents were affected.
Affected (this filing): 187
1st Source Bank reported a ransomware incident that was discovered on June 1, 2023. The breach impacted approximately 450,000 individuals, compromising their names and Social Security numbers. The bank began notifying affected parties on July 14, 2023, and offered 12 months of identity monitoring services through Kroll.
Affected (this filing): 450,000
1st Source Bank, a finance sector entity reported a ransomware incident to the Washington Attorney General. The organization became aware of the incident on 2023-06-01 and filed notice on 2023-07-20. 777 Washington residents were affected. 49 days elapsed between awareness and notification. 0 days to identify the breach. 0 days to contain the breach.
Affected (this filing): 777
1st Source Bank reported a data breach to the Oregon Attorney General. The breach was reported on 2023-07-20. The breach occurred during 6/1/2023 - 6/1/2023. The breach was discovered on 6/1/2023. 436,519 individuals were affected. Notice was sent on 7/14/20237/17/20237/18/20237/19/2023.
Affected (this filing): 436,519
1st Source Bank disclosed a data breach involving the MOVEit software vulnerability exploited by an external actor. On June 1, 2023, the bank became aware of the vulnerability alert and patched its systems. Investigation revealed that data including names, Social Security numbers, driver's license numbers, and dates of birth may have been acquired without authorization. The bank engaged cybersecurity experts and offered 12 months of identity monitoring via Kroll.
1st Source Bank filed a supplemental notice with the New Hampshire Attorney General regarding a MOVEit vulnerability incident. The bank became aware of the vulnerability on June 1, 2023, and confirmed customer PII was potentially acquired on June 24, 2023. 162 New Hampshire residents were notified. The bank partnered with Kroll to provide identity monitoring services.
Affected (this filing): 162
1st Source Bank reported a data breach to the Oregon Attorney General. The breach was reported on 2023-07-27. The breach occurred during 6/1/2023 - 6/1/2023. The breach was discovered on 6/1/2023. 446,146 individuals were affected. Notice was sent on 7/25/2023.
Affected (this filing): 446,146