Flagstar Bank, National Association

Flagstar Bank, N.A. reported a data breach impacting 168 Maine residents, which was part of a larger incident affecting 837,390 individuals in total. The breach, described as an external system hack, occurred between May 27 and May 31, 2023, and was discovered around June 3, 2023. The compromised information includes names and Social Security numbers. The filing notes that the breach did not occur on Flagstar's own systems, indicating a third-party vendor was involved. Affected individuals were notified on October 6, 2023, and offered two years of credit monitoring, fraud consultation, and identity theft restoration services through Kroll.

Affected (this filing): 168

Flagstar Bank notified Vermont and Rhode Island residents of a data breach involving third-party vendor Fiserv's use of Progress Software MOVEit Transfer. Unauthorized actors accessed files containing customer PII (names, SSNs, DOBs) between May 27-31, 2023. Flagstar engaged forensic investigation, patched systems, and provided two years of Kroll identity monitoring. 286 Rhode Island residents were explicitly identified as impacted.

Affected (this filing): 286

Flagstar Bank, N.A. notified the New Hampshire Attorney General on October 5, 2023, regarding a third-party vendor breach involving Fiserv's MOVEit Transfer system. Unauthorized actors exploited a zero-day vulnerability to access vendor files containing customer personal information (names, SSNs, DOBs) between May 27-31, 2023. The incident affected 278 New Hampshire residents. Flagstar's own systems were not directly compromised. Remediation included vendor patching and offering two years of complimentary identity monitoring via Kroll.

Affected (this filing): 278

Flagstar Bank, N.A. reported a data breach to the Montana Attorney General. The breach was reported on 2023-10-05. The breach occurred from 5/27/2023 to 5/31/2023. 304 Montana residents were affected.

Affected (this filing): 304

Flagstar Bank, N.A. notified California residents of a data breach involving its third-party vendor, Fiserv. Unauthorized actors exploited vulnerabilities in MOVEit Transfer software used by Fiserv for payment processing and mobile banking. The unauthorized activity occurred between May 27 and May 31, 2023. Customer information, including names and potentially financial account data, was disclosed. Flagstar offered two years of identity monitoring through Kroll.

Flagstar Bank, NA, a finance sector entity reported a ransomware incident to the Washington Attorney General. The organization became aware of the incident on 2023-08-03 and filed notice on 2023-10-05. 2,412 Washington residents were affected. 63 days elapsed between awareness and notification. 68 days to identify the breach. 0 days to contain the breach.

Affected (this filing): 2,412

Flagstar Bank, N.A. reported a data breach to the Oregon Attorney General. The breach was reported on 2023-10-06. 837,390 individuals were affected.

Affected (this filing): 837,390

Flagstar Bank, N.A. reported a cybersecurity incident involving its third-party vendor, FIS, utilizing MOVEit transfer software. The breach occurred between May 27 and May 31, 2023, and was discovered on August 8, 2023. Approximately 25,891 individuals were affected, including 22 Maine residents. The incident involved the unauthorized acquisition of personal information, including names and government identifiers. Flagstar notified affected individuals in writing starting November 6, 2023, and offered two years of credit monitoring and identity theft protection services through Kroll.

Affected (this filing): 25,891

Flagstar Bank, N.A. reported a data breach impacting 838,073 individuals, including 177 Maine residents, due to a security vulnerability in the MOVEit software used by its vendor, Fiserv. The breach occurred between May 27, 2023, and May 31, 2023, and was discovered on June 3, 2023. The compromised information includes names and Social Security numbers. Flagstar offered two years of credit monitoring, fraud consultation, and identity theft restoration services through Kroll to affected individuals.

Affected (this filing): 177