Breach taxonomy
Summary
SR Bancorp disclosed that Mercadien, P.C., a vendor providing internal audit-related services to Somerset Regal Bank, suffered a data security incident in which an unauthorized actor accessed and acquired files on Mercadien's servers containing bank customer data including names, Social Security numbers, account numbers, identification documents and dates of birth. The bank's own systems and operations were not impacted. Filed under Item 8.01; materiality not determined as a 1.05 incident.
Tagging rationale
ThreatUnknown
Filing refers only to 'an unauthorized actor' with no attribution -> UNKNOWN.
MethodsData ExfilSupply Chain
An unauthorized actor 'accessed and acquired certain files' on the servers of third-party vendor Mercadien -> DATA-EXFIL + SUPPLY-CHAIN.