Skip to content
Breaches.

1st Source Bank

Disclosed Jul 10, 20233 years ago450,000 affectedConfirmed

Official notice

Unauthorized party accessed 1st Source Bank's MOVEit server

1st Source Corporation told the SEC its investigation found an unauthorized party had exploited the MOVEit vulnerability on the server the bank used for internal and client file transfers.

What is known

People affected450,000 (as reported by the organization)
DisclosedJul 10, 2023
DiscoveredJun 1, 2023
HappenedMay 27, 2023
AttackSupply chain
Data exposedOther, Names, Health
SectorFinance · US
StatusConfirmed
Part ofMoveit (2023)

Sources

Source
California Attorney General breach notice: 1st Source Bankoag.ca.gov · Official notice
Washington Attorney General breach notice: 1st Source Bankatg.wa.gov · Official notice
Oregon DOJ breach notice: 1st Source Bankjustice.oregon.gov · Official notice
1st Source Corp Form 8-K (July 10, 2023)sec.gov · SEC filing
Vermont Attorney General: 2023-07-14 1st Source Bank Data Breach Notice to Consumersago.vermont.gov · Official notice
Indiana Attorney General 2023 data breach report: 1st Source Bankin.gov · Official notice
HHS OCR breach report (archive, resolved): 1st Source Bank (Business Associate, IN)ocrportal.hhs.gov · Official notice

Notices filed

WhereFiledPeople
ResearchtotalJul 10, 2023
Vermont AGresidents of VTJul 14, 2023
Indiana AGresidents of INJul 14, 2023351,762
California AGresidents of CAJul 19, 2023
Washington AGresidents of WAJul 20, 2023777
Oregon DOJresidents of ORJul 20, 2023436,519
California AGresidents of CAJul 26, 2023
Oregon DOJresidents of ORJul 27, 2023446,146
Indiana AGresidents of INSep 21, 2023344,931
HHS archivetotalNov 20, 20231,477
California AGresidents of CANov 28, 2023

Same campaign

OrganizationAffected
AmazonAmazon employee contact data leaked via property vendor's MOVEit breachNov 11, 20241 year agoVendor breachUnverifiedUnknown
AutoZoneMOVEit breach exposes data of 184,995 AutoZone customers and staffNov 20, 20232 years agoSupply chain185K
State of MaineMOVEit breach exposes data of 1.3 million people across Maine agenciesNov 10, 20232 years agoSupply chain1.3M
University of MissouriMOVEit breach exposes University of Missouri personal dataOct 20, 20232 years agoSupply chain119K
Flagstar BankFiserv MOVEit breach exposes 837,390 Flagstar customersOct 5, 20232 years agoVendor breach837K
Sony Interactive EntertainmentMOVEit zero-day exposes data of 6,791 Sony employees and relativesOct 3, 20232 years agoSupply chain6,791
BORN OntarioMOVEit breach exposes perinatal and child registry data of 3.4 millionSep 25, 20233 years agoSupply chainUnverified3.4M
WelltokMOVEit server breach exposes data of 8.5 million US patientsSep 22, 20233 years agoSupply chain15M
Cadence BankMOVEit zero-day used to steal Cadence Bank customer dataSep 15, 20233 years agoSupply chain14K
HoneywellMOVEit breach exposes pension plan participants' names and SSNsSep 13, 20233 years agoSupply chainUnknown
Pôle emploiProvider breach exposes names and social security numbers of French job seekersAug 25, 20233 years agoVendor breachUnverifiedUnknown
Colorado Department of Health Care Policy & FinancingIBM MOVEit breach exposes health data of 4.1 million Colorado Medicaid membersAug 11, 20233 years agoVendor breach4.1M
TD AmeritradeMOVEit Transfer breach exposes TD Ameritrade client SSNs and account dataAug 8, 20233 years agoSupply chainUnknown
Missouri Department of Social ServicesIBM MOVEit breach exposes Missouri Medicaid participants' dataAug 7, 20233 years agoVendor breach740K
Radius Global SolutionsCollections firm Radius hit by MOVEit breach exposing consumer dataAug 4, 20233 years agoSupply chain632K
Garrett MotionMOVEit exploitation exposes Garrett Motion company, employee and customer dataAug 2, 20233 years agoSupply chainUnknown
SercoBenefits vendor CBIZ MOVEit breach exposes Serco US staff dataAug 1, 20233 years agoVendor breach10K
Prudential FinancialPBI MOVEit breach exposes Prudential retirement payment recipientsJul 31, 20233 years agoVendor breachUnknown
Performance Health TechnologyMOVEit breach at health plan vendor exposes 1.7 million Oregon Health Plan membersJul 31, 20233 years agoSupply chain1.8M
CareSourceMOVEit hack exposes CareSource members' health and personal dataJul 27, 20233 years agoSupply chain3.2M
MaximusMOVEit breach exposes personal and health data of 8 to 11 million peopleJul 26, 20233 years agoSupply chain9.2M
Pacific Premier BankTax compliance vendor's MOVEit breach exposes bank client dataJul 25, 20233 years agoVendor breachUnknown
Johns Hopkins University and Health SystemMOVEit server breach at Johns Hopkins exposes personal informationJul 25, 20233 years agoSupply chainUnknown
Delta Dental of CaliforniaMOVEit breach exposes financial and card data of 6.9 million dental membersJul 12, 20233 years agoSupply chain7.1M
Colorado State UniversityVendor MOVEit breaches expose Colorado State University student and staff dataJul 12, 20233 years agoVendor breachUnknown
Deutsche BankAccount switching provider breach exposes Deutsche Bank customer dataJul 11, 20233 years agoVendor breachUnverifiedUnknown
ShellShell confirms employee data accessed through MOVEit TransferJul 6, 20233 years agoSupply chainUnverifiedUnknown
PlainsCapital BankCore banking vendor's MOVEit breach exposes nearly all PlainsCapital customersJul 3, 20233 years agoVendor breachUnknown
TIAAVendor PBI MOVEit breach exposes TIAA participant dataJun 30, 20233 years agoVendor breachUnknown
F&G Annuities & LifeVendor PBI MOVEit breach exposes data of many F&G policyholdersJun 30, 20233 years agoVendor breachUnknown
UCLAUCLA confirms MOVEit Transfer compromise and notifies affected peopleJun 29, 20233 years agoSupply chainUnverifiedUnknown
Siemens EnergySiemens Energy confirms it was targeted in MOVEit attacksJun 29, 20233 years agoSupply chainUnverifiedUnknown
National Student ClearinghouseMOVEit breach at student records nonprofit affects 890 schoolsJun 29, 20233 years agoSupply chainUnknown
Talcott ResolutionVendor PBI MOVEit breach exposes over half a million Talcott customersJun 27, 20233 years agoVendor breachUnknown
New York City Department of EducationMOVEit breach exposes data of about 45,000 NYC students and staffJun 26, 20233 years agoSupply chainUnverifiedUnknown
Jackson National Life InsuranceVendor PBI MOVEit breach exposes 700,000 to 800,000 Jackson customersJun 26, 20233 years agoVendor breach853K
Corebridge FinancialVendor MOVEit breach exposes Corebridge customers' SSNs and policy numbersJun 26, 20233 years agoVendor breach6.5M
Wilton ReassuranceVendor PBI MOVEit breach exposes 1.48 million insurance customersJun 22, 20233 years agoVendor breach1.5M
Umpqua BankVendor and on-premise MOVEit breaches expose Umpqua customers' SSNsJun 22, 20233 years agoVendor breach429K
PBI Research ServicesMOVEit breach at pension death-audit vendor exposes millions of insurer customersJun 22, 20233 years agoSupply chainUnknown
History of this record
  • 2026-09-25 · data_types: ["other"] to ["other","names","health"] · backfill source
  • 2026-09-25 · records_basis: empty to organization · backfill source
  • 2026-09-25 · records: empty to 450000 · backfill source
  • 2026-09-25 · source: empty to https://ago.vermont.gov/document/2023-07-14-1st-source-bank-data-breach-notice-consumers · backfill source
  • 2026-09-25 · campaign: empty to moveit-2023 · seed source
  • 2026-09-25 · attack: ransomware to supply-chain · seed source
  • 2026-09-25 · data_types: [] to ["other"] · seed source
  • 2026-09-25 · disclosed: 2023-07-19 to 2023-07-10 · seed source
  • 2026-09-25 · summary: empty to 1st Source Corporation told the SEC its investigation found an unauthorized party had exploited the MOVEit vulnerability on the server the bank used for internal and client file transfers. · seed source
  • 2026-09-25 · title: empty to Unauthorized party accessed 1st Source Bank's MOVEit server · seed source
  • 2026-09-25 · attack: unknown to ransomware · backfill source
  • 2026-09-25 · discovered: empty to 2023-06-01 · backfill source
  • 2026-09-25 · disclosed: 2023-07-26 to 2023-07-19 · backfill source
  • 2026-09-25 · disclosed: 2023-11-28 to 2023-07-26 · backfill source
  • 2026-09-25 · added · backfill source

First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.

Everything about 1st Source Bank

New breaches by email

Wednesdays, only in weeks with newly disclosed breaches, the largest first.

Double opt-in. Unsubscribe any time.