KeyBank National Association

The Maine Office of the Attorney General disclosed a data breach affecting KeyBank National Association on April 13, 2023, after its discovery on March 10, 2023. The incident involved the inadvertent exposure of Social Security Numbers (SSNs) belonging to two individuals, though the exact cause (e.g., misconfigured database, human error, or third-party mishandling) was not specified. While the breach was limited in scale, the exposure of SSNs—highly sensitive personally identifiable information (PII)—poses a significant risk of identity theft or fraudulent activity. In response, KeyBank offered 24 months of identity theft protection services through Equifax Complete Premier to the affected individuals, mitigating potential long-term harm. The breach did not indicate broader systemic compromise, ransomware involvement, or large-scale data exfiltration, but the nature of the exposed data (SSNs) elevates its severity due to the potential for financial and reputational damage to the impacted parties.

Source: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/b9ae3393-cb60-4a33-bb68-f434dbef6af4.shtml

TPRM report: https://www.rankiteo.com/company/keycorp

"id": "key004091825",
"linkid": "keycorp",
"type": "Breach",
"date": "4/2020",
"severity": "60",
"impact": "3",
"explanation": "Attack with significant impact with internal employee data leaks"

{'affected_entities': [{'customers_affected': 2,
                        'industry': 'Banking/Financial Services',
                        'location': 'United States (Maine reported)',
                        'name': 'KeyBank National Association',
                        'type': 'Financial Institution'}],
 'customer_advisories': ['Offered 24 months of identity theft protection via '
                         'Equifax Complete Premier'],
 'data_breach': {'number_of_records_exposed': 2,
                 'personally_identifiable_information': True,
                 'sensitivity_of_data': 'High',
                 'type_of_data_compromised': ['Social Security Numbers']},
 'date_detected': '2023-03-10',
 'date_publicly_disclosed': '2023-04-13',
 'description': 'The Maine Office of the Attorney General reported a data '
                'breach involving KeyBank National Association. The breach '
                'involved inadvertent disclosure of Social Security Numbers '
                'affecting 2 individuals. Identity theft protection services '
                '(Equifax Complete Premier) were offered for 24 months.',
 'impact': {'data_compromised': ['Social Security Numbers'],
            'identity_theft_risk': 'High (SSNs exposed)'},
 'references': [{'date_accessed': '2023-04-13',
                 'source': 'Maine Office of the Attorney General'}],
 'regulatory_compliance': {'regulatory_notifications': ['Maine Office of the '
                                                        'Attorney General']},
 'response': {'recovery_measures': ['Offered 24 months of Equifax Complete '
                                    'Premier identity theft protection'],
              'third_party_assistance': ['Equifax (identity theft '
                                         'protection)']},
 'title': 'KeyBank National Association Data Breach (2023)',
 'type': 'Data Breach'}