2023–2024 State Street — Fiserv / MOVEit check-image exposure; Mass. regulatory mirror
Data compromised
Check images and payee financial identifiers per state-filed sample notices
Technical writeup
State Street Corporation regulatory letters summarized in Massachusetts breach indexing described an October 2023 vendor alert from Fiserv that criminals had exploited the Progress MOVEit Transfer vulnerability, potentially exposing imaged check and payment metadata for retirement-plan participants: payee names, addresses, phones, bank routing and account numbers, and limited handwritten ID-class fields. Consumer mailings and AG filings rolled into early 2024.
Root cause
Third-party managed file transfer compromise in the global Cl0p MOVEit campaign