Hatch Bank hatchbank.com Hatch Bank data breach: what happened and what to do
Hatch Bank said that attackers exploiting a flaw in a vendor's GoAnywhere file transfer software took names and Social Security numbers in late January 2023. TechCrunch reported close to 140,000 people. Hatch began notifying people on February 28, 2023.
View all 13,177 breaches- Breach date
- 30 Jan 2023
- Made public
- 28 Feb 2023
- Data exposed
- Names, Social security numbers
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
Hatch Bank is a digital bank that serves small businesses and fintech partners. It disclosed in February 2023 that a breach at one of its technology vendors exposed customer data.
What happened
Hatch's notice says that on February 3, 2023 it learned that its vendor Fortra had suffered a cyber incident. Fortra makes GoAnywhere MFT, a file transfer tool that attackers exploited through a previously unknown flaw in early 2023. Hatch's data was affected through that tool. The Maine filing places the intrusion at the end of January 2023. Written notice began on or about February 28, 2023.
Sources checked: maine.gov, techcrunch.com, oag.ca.gov
Last verified against the official page:
What was exposed
Hatch's notice and press coverage of the Maine filing say names and Social Security numbers were taken. TechCrunch reported the number as close to 140,000 people. The 631 Maine residents in the state filing are one state's share, not the total.
The company's response
Hatch notified affected people and offered a year of free credit monitoring through Cyberscout according to reports on the notice. If you were affected, the notice letter tells you how to enroll.
What it means for you
A name plus a Social Security number is what lenders use to verify identity, so the risk is fraudulent credit applications. Freeze your credit and review your reports.
What to do if you were in it
- 1
Freeze your credit at all three bureaus
A freeze stops new credit being opened in your name and costs nothing. Place it with Equifax, Experian and TransUnion; the FTC explains how at consumer.ftc.gov. Lift it temporarily when you apply for credit yourself.
- 2
Read the notice letter and use the protection it offers
If a letter arrived, it lists what was exposed and often includes free credit monitoring or identity restoration with an enrollment deadline. Sign up before that date passes.
- 3
Watch your statements and credit reports
Check bank and card statements for charges you don't recognize, and pull your free credit reports at AnnualCreditReport.com. If something is wrong, report it at IdentityTheft.gov and follow the recovery plan it gives you.
- 4
Expect phishing that mentions the breach
Scammers use news of a breach to sound legitimate. Don't click links or call numbers in unexpected texts or emails about it. Contact the company through the phone number or site on your own card or statement.
- 5
Check whether your email or phone is in this and other breaches
Serus monitors breach databases and the dark web and alerts you when your details appear, with steps for each case. A free scan shows where you stand today.
Official filings
- Washington Attorney General , filed 28 Feb 2023 : 2,580 people
Timeline
-
The breach happened
-
The company made it public
-
Reported to the Washington Attorney General
Frequently asked
Was I affected by this breach?
Check the notice letter you received. Organizations usually mail one to each person whose data was involved. If you have no letter and think your data was held, contact Hatch Bank using the details on its own website.
Should I freeze my credit?
If your Social Security number or similar ID details were exposed, the FTC says a credit freeze is a free way to block new accounts being opened in your name. Place it with Equifax, Experian and TransUnion.
What should I do if I get a message about the breach?
Treat it with care. Criminals send fake breach alerts. Go to the company's own site or the number on your statements instead of using a link or number in the message.
Sources
- maine.gov/ag/attachments/985235c7-cb95-4be2-8792-a1252b4f8318/4cfbf86f-8d04-4296-9195-81b874ba939a/b9956f3a-4e3c-4917-9feb-440cec96f8e4/Notice%20of%20Data%20Event%20-%20Hatch%20-%20ME.pdf
- techcrunch.com/2023/03/02/hatch-bank-breach-fortra-goanywhere-exploit/
- oag.ca.gov/system/files/Hatch%20Sample%20Notice.pdf
- consumer.ftc.gov/articles/what-know-about-credit-freezes-and-fraud-alerts
- identitytheft.gov/databreach
Something wrong or out of date? Tell us and we'll re-check it.
