Business Context and Reporting Period
This Form 8-K was filed by FirstSun Capital Bancorp on July 14, 2023, reporting a cybersecurity incident involving its wholly-owned subsidiary, Sunflower Bank, N.A. The report addresses a data breach stemming from a zero-day vulnerability in third-party software used for file transfers.
Key Financial Metrics
The filing does not provide specific financial figures such as revenue, profit, cash flow, margins, debt, or liquidity. It notes that the Bank has incurred and may continue to incur expenses related to the incident, including costs for response, remediation, and investigation, but does not quantify these amounts.
Material Changes and Incident Details
- Incident Source: A zero-day vulnerability in Progress Software Corporation's MOVEit managed file transfer software.
- Scope: The software is used by the Bank's First National 1870 and Guardian Mortgage divisions for transferring sensitive data. It operates on a segmented on-premises server and is not part of the Bank's core processing systems.
- Impact: An unauthorized party likely downloaded files containing personally identifiable information (PII) before the vulnerability was disclosed. Core processing systems were not impacted, and there was no material interruption to business operations.
- Response: The Bank implemented all issued fixes, retained a third-party forensic expert, and launched a comprehensive investigation to identify affected data and notify impacted parties.
Outlook, Risks, and Contingencies
Management highlights several risks and uncertainties associated with the incident:
- Financial Exposure: Ongoing costs for investigation, remediation, and potential litigation.
- Legal and Regulatory: The incident may lead to litigation and additional regulatory scrutiny.
- Reputational Risk: Potential damage to the Bank's reputation due to the data breach.
- Insurance: The extent of insurance coverage and contractual indemnification remains under evaluation.
The filing includes a standard caution regarding forward-looking statements, noting that actual results may differ materially due to the evolving nature of the investigation and associated costs.
Investor Verification Checklist
- Verify the final scope of personally identifiable information (PII) exposed during the investigation.
- Monitor future filings for quantified costs related to remediation, legal fees, and regulatory fines.
- Assess the status of any pending or threatened litigation arising from the breach.
- Review the Bank's insurance coverage limits and any gaps in indemnification for this specific incident.
- Confirm that no further vulnerabilities have been discovered in the Bank's segmented IT infrastructure.