BAML
Company Details
Linkedin ID:
bank-of-america-merrill-lynch
Website:
Employees number:
16,629
Number of followers:
378,410
NAICS:
52
Industry Type:
Homepage:
bofaml.com
IP Addresses:
0
Company ID:
BAN_2040524
Scan Status:
In-progress
Bank of America Merrill Lynch Company CyberSecurity Posture
bofaml.com
From local communities to global markets, we are dedicated to shaping the future responsibly and helping clients thrive in a changing world. “Bank of America Merrill Lynch” is the marketing name for the global banking and global markets businesses of Bank of America Corporation. Bank of America is a marketing name for the Retirement Services business of Bank of America Corporation. Lending, derivatives, and other commercial banking activities are performed globally by banking affiliates of Bank of America Corporation, including Bank of America, N.A., Member FDIC. Securities, strategic advisory, and other investment banking activities are performed globally by investment banking affiliates of Bank of America Corporation (“Investment Banking Affiliates”), including, in the United States, BofA Securities, Inc., Merrill Lynch, Pierce, Fenner & Smith Incorporated, and Merrill Lynch Professional Clearing Corp., all of which are registered broker-dealers and Members of SIPC, and in other jurisdictions, by locally registered entities. BofA Securities, Inc., Merrill Lynch, Pierce, Fenner & Smith Incorporated and Merrill Lynch Professional Clearing Corp. are registered as futures commission merchants with the CFTC and are members of the NFA. Investment products: Are Not FDIC Insured May Lose Value Are Not Bank Guaranteed Any opinions, views, statements, estimates or projections (“posts”) posted on this web page are solely those of the individual author(s). As such, posts by an employee of BofAML or any of its affiliates are solely those of such employee or agent and do not necessarily reflect the views of BofAML. BofAML is not responsible for the content, or output of external websites. For Terms and Conditions and Disclaimers, please visit go.bofaml.com/social. Bank of America LinkedIn Community Guidelines can be found at: http://about.bankofamerica.com/en-us/social-media/linkedin-community-guidelines.html
Bank of America Merrill Lynch A.I CyberSecurity Scoring
BAML Risk Score (AI oriented)Between 750 and 799
BAML
Updated:
- Powered by our proprietary A.I cyber incident model
- Insurance preferes TPRM score to calculate premium
BAML Global Score (TPRM)XXXX
BAML
- Instant access to detailed risk factors
- Benchmark vs. industry & size peers
- Vulnerabilities
- Findings
BAML Company CyberSecurity News & History
Past Incidents
4
Attack Types
2
Bank of America
Breach
Rankiteo Explanation
Attack limited on finance or reputation
Description: The Maine Office of the Attorney General reported a data breach related to Bank of America on March 3, 2025, involving an inadvertent disclosure that occurred on February 18, 2025. One individual was affected, and the compromised information included personal details such as names and Social Security numbers. Bank of America offered a complimentary two-year identity theft protection service by Experian.
Bank of America
Breach
Rankiteo Explanation
Attack with significant impact with customers data leaks
Description: The Maine Office of the Attorney General disclosed a data breach affecting Bank of America, detected on October 1, 2024, and reported on January 3, 2025. The incident involved unauthorized access to sensitive personal information, compromising 414 individuals, including at least one Maine resident. While the exact nature of the exposed data was not fully detailed, the breach was severe enough to warrant 24 months of free identity theft protection services via Experian, suggesting the exposure of personally identifiable information (PII) that could facilitate fraud or identity theft. The breach highlights vulnerabilities in Bank of America’s data security measures, raising concerns over potential financial fraud, reputational damage, and regulatory scrutiny. Although the scale (414 individuals) is relatively contained compared to mass breaches, the provision of long-term identity protection indicates a high-risk exposure likely involving financial or identity-related data (e.g., Social Security numbers, account details, or addresses). The incident underscores the persistent threat of cyber intrusions targeting financial institutions, where even limited breaches can have cascading consequences for affected individuals, including phishing attacks, unauthorized transactions, or credit fraud.
Merrill, A Bank of America Company
Breach
Rankiteo Explanation
Attack with significant impact with internal employee data leaks
Description: On April 16, 2024, the Maine Office of the Attorney General disclosed that Bank of America suffered an inadvertent data breach caused by a Merrill employee’s email error, leading to the unauthorized exposure of customer information. The incident impacted 2,676 individuals, including 18 Maine residents, though the exact nature of the exposed data (e.g., financial details, personal identifiers) was not fully specified. In response, Bank of America offered affected individuals two years of complimentary identity theft protection via Experian IdentityWorks™ to mitigate potential risks such as fraud or identity misuse. The breach did not involve malicious cyber activity like hacking or ransomware but stemmed from human error, highlighting vulnerabilities in internal data-handling protocols. While no evidence suggested exploitation of the exposed data, the incident underscored the reputational and operational risks associated with employee-driven data leaks, particularly for a major financial institution. The breach’s scope though limited in scale raised concerns about compliance with data protection regulations and the bank’s ability to safeguard sensitive customer information.
Bank of America
Data Leak
Rankiteo Explanation
Attack with significant impact with internal employee data leaks
Description: Business clients applying for Paycheck Protection Program (PPP) loans with Bank of America have had their personal and business information exposed in a data breach. The data breach occurred on April 22 as Bank of America uploaded customers’ PPP loan applications to the Small Business Administration’s (SBA) online testing system, which allowed lenders to test application submissions. During the testing process, Application information was potentially visible to other lenders and their third-party vendors. The exposed data included both business and clients’ personal information. The affected business data may include business names, addresses, and tax identification numbers. Affected personal data may include names, addresses, Social Security numbers, phone numbers, email addresses, and citizenship information.
BAML Company Scoring based on AI Models
Cyber Incidents Likelihood 3 - 6 - 9 months
A.I Risk Score Likelihood 3 - 6 - 9 months
Underwriter Stats for BAML
Incidents vs Financial Services Industry Average (This Year)
No incidents recorded for Bank of America Merrill Lynch in 2026.
Incidents vs All-Companies Average (This Year)
No incidents recorded for Bank of America Merrill Lynch in 2026.
Incident Types BAML vs Financial Services Industry Avg (This Year)
No incidents recorded for Bank of America Merrill Lynch in 2026.
Incident History — BAML (X = Date, Y = Severity)
BAML cyber incidents detection timeline including parent company and subsidiaries
BAML Company Subsidiaries
From local communities to global markets, we are dedicated to shaping the future responsibly and helping clients thrive in a changing world. “Bank of America Merrill Lynch” is the marketing name for the global banking and global markets businesses of Bank of America Corporation. Bank of America is a marketing name for the Retirement Services business of Bank of America Corporation. Lending, derivatives, and other commercial banking activities are performed globally by banking affiliates of Bank of America Corporation, including Bank of America, N.A., Member FDIC. Securities, strategic advisory, and other investment banking activities are performed globally by investment banking affiliates of Bank of America Corporation (“Investment Banking Affiliates”), including, in the United States, BofA Securities, Inc., Merrill Lynch, Pierce, Fenner & Smith Incorporated, and Merrill Lynch Professional Clearing Corp., all of which are registered broker-dealers and Members of SIPC, and in other jurisdictions, by locally registered entities. BofA Securities, Inc., Merrill Lynch, Pierce, Fenner & Smith Incorporated and Merrill Lynch Professional Clearing Corp. are registered as futures commission merchants with the CFTC and are members of the NFA. Investment products: Are Not FDIC Insured May Lose Value Are Not Bank Guaranteed Any opinions, views, statements, estimates or projections (“posts”) posted on this web page are solely those of the individual author(s). As such, posts by an employee of BofAML or any of its affiliates are solely those of such employee or agent and do not necessarily reflect the views of BofAML. BofAML is not responsible for the content, or output of external websites. For Terms and Conditions and Disclaimers, please visit go.bofaml.com/social. Bank of America LinkedIn Community Guidelines can be found at: http://about.bankofamerica.com/en-us/social-media/linkedin-community-guidelines.html
Loading...
BAML Similar Companies
Ameriprise Financial Services, LLC
At Ameriprise Financial, we have been helping people feel more confident about their financial future for 130 years. With extensive investment advice, asset management and insurance capabilities and a nationwide network of approximately 10,000 financial advisors*, we have the strength and expertise
IFC, a member of the World Bank Group, is the largest global development institution focused exclusively on the private sector in developing countries. We utilize and leverage our products and services—as well as products and services of other institutions in the World Bank Group—to provide develop
Chase
At Chase, we’re dedicated to helping you succeed. Whether you’re in need of banking, credit cards, mortgages, auto financing, investment guidance, small business support, or payment solutions, we’re beside you every step of the way. For customer service, contact us via chase.com/customerservice. S
Fidelity Investments
Fidelity’s mission is to strengthen the financial well-being of our customers and deliver better outcomes for the clients and businesses we serve. Fidelity’s strength comes from the scale of our diversified, market-leading financial services businesses that serve individuals, families, employers, we
Founded in 2006, CreditEase is a Beijing-based world-leading FinTech conglomerate in China. It specializes in inclusive finance and wealth management with a dominant position in credit technology, wealth management technology, insurance technology, etc. Main business sectors of CreditEase include Yi
S&P Global (NYSE: SPGI) enables businesses, governments, and individuals with trusted data, expertise and technology to make decisions with conviction. We are Advancing Essential Intelligence through world-leading benchmarks, data, and insights that customers need in order to plan confidently, act d
BNP Paribas CIB
In a changing world, we aim at anticipating transformation and driving your company for success. We are convinced to have the expertise and networks you need to develop your business. BNP Paribas Corporate and Institutional Banking is a leading global financial partner, offering you a wide range of
OTP Group
OTP Group is one of the fastest growing, leading independent banking groups in Central and Eastern Europe with a bridgehead in Central Asia. It operates in 11 countries - 10 in CEE region and 1 in Uzbekistan, employing nearly 40,000 people and providing universal financial services to 17 million cu
Truist Financial Corporation is a purpose-driven financial services company committed to inspiring and building better lives and communities. As a leading U.S. commercial bank, Truist has leading market share in many of the high-growth markets across the country. Truist offers a wide range of produc
.png)
BAML CyberSecurity News
November 05, 2025 08:00 AM
Merrill Wealth Aims to Double Growth In Several Years
Bank of America's Merrill plans to achieve 4%-5% annual organic growth by tapping into millions of BoA clients and shifting toward fee-based...
August 11, 2025 07:00 AM
48 CIOs On the Move
This month, we're highlighting 48 CIOs, CTOs, and CISOs taking on leadership roles in industries from healthcare to finance to technology.
May 03, 2025 08:25 PM
Bank of America confirms data breach compromised customer data in November 2023
Who: Bank of America warned customers they may have been affected by a November 2023 data breach that occurred as a result of a cybersecurity incident...
May 01, 2025 07:00 AM
Bankers fear relay-fraud comeback and Synapse issues in May
Fintechs acquiring banks are trending once again, as are the problematic levels of relay fraud, bots conducting cyber attacks against banks...
February 14, 2025 08:00 AM
Merrill Edge Safety Review: How Secure is Your Information?
Launched by Bank of America, Merrill Edge is a secure investment app with backing from one of the largest banks in the United States.
February 12, 2025 12:47 PM
Merrill Video Pro Is Live for the Thundering Herd
Bank of America Merrill Lynch has built and launched a virtual video studio for its thousands of advisors.
February 12, 2025 12:00 PM
Bank of America Merrill Lynch Expands Zero-Dollar Trading
Bank of America has made unlimited commission-free stock, ETF and options trading available to all Merrill Edge Self-Directed investors.
February 12, 2025 06:41 AM
Bank of America Says Black Advisors Make Up 4.5% of Merrill Wealth Managers
Over the past 18 months, 54% of Merrill Lynch Wealth Management's advisor hires have come from diverse backgrounds, up from 39% in 2017.
February 12, 2025 12:47 AM
Merrill Lynch Clients Can Now Trade Within BofA App
Bank of America announced Monday several additions to its mobile banking application, including an integration with its Merrill Lynch unit that allows...
Frequently Asked Questions
Explore insights on cybersecurity incidents, risk posture, and Rankiteo's assessments.
BAML CyberSecurity History Information
Official Website of Bank of America Merrill Lynch
The official website of Bank of America Merrill Lynch is http://www.bofaml.com.
Bank of America Merrill Lynch’s AI-Generated Cybersecurity Score
According to Rankiteo, Bank of America Merrill Lynch’s AI-generated cybersecurity score is 787, reflecting their Fair security posture.
How many security badges does Bank of America Merrill Lynch’ have ?
According to Rankiteo, Bank of America Merrill Lynch currently holds 0 security badges, indicating that no recognized compliance certifications are currently verified for the organization.
Has Bank of America Merrill Lynch been affected by any supply chain cyber incidents ?
According to Rankiteo, Bank of America Merrill Lynch has not been affected by any supply chain cyber incidents, and no incident IDs are currently listed for the organization.
Does Bank of America Merrill Lynch have SOC 2 Type 1 certification ?
According to Rankiteo, Bank of America Merrill Lynch is not certified under SOC 2 Type 1.
Does Bank of America Merrill Lynch have SOC 2 Type 2 certification ?
According to Rankiteo, Bank of America Merrill Lynch does not hold a SOC 2 Type 2 certification.
Does Bank of America Merrill Lynch comply with GDPR ?
According to Rankiteo, Bank of America Merrill Lynch is not listed as GDPR compliant.
Does Bank of America Merrill Lynch have PCI DSS certification ?
According to Rankiteo, Bank of America Merrill Lynch does not currently maintain PCI DSS compliance.
Does Bank of America Merrill Lynch comply with HIPAA ?
According to Rankiteo, Bank of America Merrill Lynch is not compliant with HIPAA regulations.
Does Bank of America Merrill Lynch have ISO 27001 certification ?
According to Rankiteo,Bank of America Merrill Lynch is not certified under ISO 27001, indicating the absence of a formally recognized information security management framework.
Industry Classification of Bank of America Merrill Lynch
Bank of America Merrill Lynch operates primarily in the Financial Services industry.
Number of Employees at Bank of America Merrill Lynch
Bank of America Merrill Lynch employs approximately 16,629 people worldwide.
Subsidiaries Owned by Bank of America Merrill Lynch
Bank of America Merrill Lynch presently has no subsidiaries across any sectors.
Bank of America Merrill Lynch’s LinkedIn Followers
Bank of America Merrill Lynch’s official LinkedIn profile has approximately 378,410 followers.
NAICS Classification of Bank of America Merrill Lynch
Bank of America Merrill Lynch is classified under the NAICS code 52, which corresponds to Finance and Insurance.
Bank of America Merrill Lynch’s Presence on Crunchbase
No, Bank of America Merrill Lynch does not have a profile on Crunchbase.
Bank of America Merrill Lynch’s Presence on LinkedIn
Yes, Bank of America Merrill Lynch maintains an official LinkedIn profile, which is actively utilized for branding and talent engagement, which can be accessed here: https://www.linkedin.com/company/bank-of-america-merrill-lynch.
Cybersecurity Incidents Involving Bank of America Merrill Lynch
As of January 21, 2026, Rankiteo reports that Bank of America Merrill Lynch has experienced 4 cybersecurity incidents.
Number of Peer and Competitor Companies
Bank of America Merrill Lynch has an estimated 30,814 peer or competitor companies worldwide.
What types of cybersecurity incidents have occurred at Bank of America Merrill Lynch ?
Incident Types: The types of cybersecurity incidents that have occurred include Breach and Data Leak.
How does Bank of America Merrill Lynch detect and respond to cybersecurity incidents ?
Detection and Response: The company detects and responds to cybersecurity incidents through an third party assistance with experian, and remediation measures with complimentary two-year identity theft protection service, and incident response plan activated with likely (standard protocol for data breaches), and third party assistance with experian (identityworks™ services), and remediation measures with offering 2-year complimentary identity theft protection (experian identityworks™), and communication strategy with notification to affected individuals via maine ag report, and third party assistance with experian (identity theft protection)..
Incident Details
Can you provide details on each incident ?
Title: Bank of America PPP Loan Data Breach
Description: Business clients applying for Paycheck Protection Program (PPP) loans with Bank of America have had their personal and business information exposed in a data breach.
Date Detected: April 22, 2020
Type: Data Breach
Attack Vector: Improper Data Handling
Vulnerability Exploited: Improper Data Handling
Title: Bank of America Data Breach
Description: The Maine Office of the Attorney General reported a data breach related to Bank of America on March 3, 2025, involving an inadvertent disclosure that occurred on February 18, 2025. One individual was affected, and the compromised information included personal details such as names and Social Security numbers. Bank of America offered a complimentary two-year identity theft protection service by Experian.
Date Detected: 2025-02-18
Date Publicly Disclosed: 2025-03-03
Type: Data Breach
Attack Vector: Inadvertent Disclosure
Title: Bank of America Inadvertent Disclosure of Customer Information via Merrill Employee Email Error
Description: The Maine Office of the Attorney General reported that Bank of America experienced an inadvertent disclosure of customer information on April 16, 2024, due to a Merrill employee email error, affecting a total of 2,676 individuals, including 18 Maine residents. Bank of America is offering a complimentary two-year membership in identity theft protection services through Experian IdentityWorks™.
Date Detected: 2024-04-16
Date Publicly Disclosed: 2024-04-16
Type: Data Breach (Inadvertent Disclosure)
Attack Vector: Human Error (Email Misconfiguration)
Title: Bank of America Data Breach (2024)
Description: The Maine Office of the Attorney General reported a data breach involving Bank of America. The breach occurred on October 1, 2024, affecting 414 individuals, including 1 resident of Maine. Unauthorized access was detected, and identity theft protection services (24 months via Experian) were offered to affected individuals.
Date Detected: 2024-10-01
Date Publicly Disclosed: 2025-01-03
Type: Data Breach
What are the most common types of attacks the company has faced ?
Common Attack Types: The most common types of attacks the company has faced is Breach.
Impact of the Incidents
What was the impact of each incident ?
Incident : Data Breach BAN2212291222
Data Compromised: Business names, Addresses, Tax identification numbers, Names, Social security numbers, Phone numbers, Email addresses, Citizenship information
Incident : Data Breach BAN832072725
Data Compromised: Names, Social security numbers
Identity Theft Risk: High
Incident : Data Breach (Inadvertent Disclosure) BAN721082025
Data Compromised: Customer information
Brand Reputation Impact: Potential (Mitigated by Identity Theft Protection Offer)
Identity Theft Risk: High (Mitigated by Experian IdentityWorks™ Offer)
Incident : Data Breach BAN030091825
Identity Theft Risk: True
What types of data are most commonly compromised in incidents ?
Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Business Names, Addresses, Tax Identification Numbers, Names, Social Security Numbers, Phone Numbers, Email Addresses, Citizenship Information, , Personal Information, and Customer Information (Details Unspecified).
Which entities were affected by each incident ?
Incident : Data Breach BAN2212291222
Entity Name: Bank of America
Entity Type: Financial Institution
Industry: Banking
Incident : Data Breach BAN832072725
Entity Name: Bank of America
Entity Type: Financial Institution
Industry: Banking
Customers Affected: 1
Incident : Data Breach (Inadvertent Disclosure) BAN721082025
Entity Name: Bank of America (via Merrill)
Entity Type: Financial Institution
Industry: Banking/Financial Services
Location: United States (Maine residents among affected)
Size: Large (Multinational)
Customers Affected: 2,676 (including 18 Maine residents)
Incident : Data Breach BAN030091825
Entity Name: Bank of America
Entity Type: Financial Institution
Industry: Banking/Financial Services
Location: United States
Customers Affected: 414
Response to the Incidents
What measures were taken in response to each incident ?
Incident : Data Breach BAN832072725
Third Party Assistance: Experian.
Remediation Measures: Complimentary two-year identity theft protection service
Incident : Data Breach (Inadvertent Disclosure) BAN721082025
Incident Response Plan Activated: Likely (Standard Protocol for Data Breaches)
Third Party Assistance: Experian (Identityworks™ Services).
Remediation Measures: Offering 2-year complimentary identity theft protection (Experian IdentityWorks™)
Communication Strategy: Notification to affected individuals via Maine AG report
Incident : Data Breach BAN030091825
Third Party Assistance: Experian (Identity Theft Protection).
What is the company's incident response plan?
Incident Response Plan: The company's incident response plan is described as Likely (Standard Protocol for Data Breaches).
How does the company involve third-party assistance in incident response ?
Third-Party Assistance: The company involves third-party assistance in incident response through Experian, , Experian (IdentityWorks™ Services), , Experian (Identity Theft Protection), .
Data Breach Information
What type of data was compromised in each breach ?
Incident : Data Breach BAN2212291222
Type of Data Compromised: Business names, Addresses, Tax identification numbers, Names, Social security numbers, Phone numbers, Email addresses, Citizenship information
Sensitivity of Data: High
Incident : Data Breach BAN832072725
Type of Data Compromised: Personal information
Number of Records Exposed: 1
Sensitivity of Data: High
Personally Identifiable Information: NamesSocial Security numbers
Incident : Data Breach (Inadvertent Disclosure) BAN721082025
Type of Data Compromised: Customer Information (Details Unspecified)
Number of Records Exposed: 2,676
Sensitivity of Data: Moderate to High (PII likely included)
Personally Identifiable Information: Likely (Given Identity Theft Protection Offer)
Incident : Data Breach BAN030091825
Number of Records Exposed: 414
What measures does the company take to prevent data exfiltration ?
Prevention of Data Exfiltration: The company takes the following measures to prevent data exfiltration: Complimentary two-year identity theft protection service, , Offering 2-year complimentary identity theft protection (Experian IdentityWorks™), .
Regulatory Compliance
Were there any regulatory violations and fines imposed for each incident ?
Incident : Data Breach (Inadvertent Disclosure) BAN721082025
Regulatory Notifications: Maine Office of the Attorney General
Incident : Data Breach BAN030091825
Regulatory Notifications: Maine Office of the Attorney General
References
Where can I find more information about each incident ?
Incident : Data Breach BAN832072725
Source: Maine Office of the Attorney General
Date Accessed: 2025-03-03
Incident : Data Breach (Inadvertent Disclosure) BAN721082025
Source: Maine Office of the Attorney General
Date Accessed: 2024-04-16
Incident : Data Breach BAN030091825
Source: Maine Office of the Attorney General
Date Accessed: 2025-01-03
Where can stakeholders find additional resources on cybersecurity best practices ?
Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: Maine Office of the Attorney GeneralDate Accessed: 2025-03-03, and Source: Maine Office of the Attorney GeneralDate Accessed: 2024-04-16, and Source: Maine Office of the Attorney GeneralDate Accessed: 2025-01-03.
Investigation Status
What is the current status of the investigation for each incident ?
Incident : Data Breach (Inadvertent Disclosure) BAN721082025
Investigation Status: Disclosed (No Further Details)
How does the company communicate the status of incident investigations to stakeholders ?
Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through Notification To Affected Individuals Via Maine Ag Report.
Stakeholder and Customer Advisories
Were there any advisories issued to stakeholders or customers for each incident ?
Incident : Data Breach (Inadvertent Disclosure) BAN721082025
Customer Advisories: Offer of 2-year Experian IdentityWorks™ membership
Incident : Data Breach BAN030091825
Customer Advisories: Identity theft protection services (24 months via Experian) offered to affected individuals
What advisories does the company provide to stakeholders and customers following an incident ?
Advisories Provided: The company provides the following advisories to stakeholders and customers following an incident: were Offer Of 2-Year Experian Identityworks™ Membership, , Identity Theft Protection Services (24 Months Via Experian) Offered To Affected Individuals and .
Post-Incident Analysis
What were the root causes and corrective actions taken for each incident ?
Incident : Data Breach (Inadvertent Disclosure) BAN721082025
Root Causes: Human Error (Merrill Employee Email Misconfiguration),
What is the company's process for conducting post-incident analysis ?
Post-Incident Analysis Process: The company's process for conducting post-incident analysis is described as Experian, , Experian (Identityworks™ Services), , Experian (Identity Theft Protection), .
Additional Questions
Incident Details
What was the most recent incident detected ?
Most Recent Incident Detected: The most recent incident detected was on April 22, 2020.
What was the most recent incident publicly disclosed ?
Most Recent Incident Publicly Disclosed: The most recent incident publicly disclosed was on 2025-01-03.
Impact of the Incidents
What was the most significant data compromised in an incident ?
Most Significant Data Compromised: The most significant data compromised in an incident were Business names, Addresses, Tax identification numbers, Names, Social Security numbers, Phone numbers, Email addresses, Citizenship information, , Names, Social Security numbers, , Customer Information, and .
Response to the Incidents
What third-party assistance was involved in the most recent incident ?
Third-Party Assistance in Most Recent Incident: The third-party assistance involved in the most recent incident was experian, , experian (identityworks™ services), , experian (identity theft protection), .
Data Breach Information
What was the most sensitive data compromised in a breach ?
Most Sensitive Data Compromised: The most sensitive data compromised in a breach were Social Security numbers, Names, Business names, Phone numbers, Email addresses, Citizenship information, Customer Information, Tax identification numbers and Addresses.
What was the number of records exposed in the most significant breach ?
Number of Records Exposed in Most Significant Breach: The number of records exposed in the most significant breach was 3.1K.
References
What is the most recent source of information about an incident ?
Most Recent Source: The most recent source of information about an incident is Maine Office of the Attorney General.
Investigation Status
What is the current status of the most recent investigation ?
Current Status of Most Recent Investigation: The current status of the most recent investigation is Disclosed (No Further Details).
Stakeholder and Customer Advisories
What was the most recent customer advisory issued ?
Most Recent Customer Advisory: The most recent customer advisory issued were an Offer of 2-year Experian IdentityWorks™ membership and Identity theft protection services (24 months via Experian) offered to affected individuals.
.png)
Latest Global CVEs (Not Company-Specific)
Description
SummaryA command injection vulnerability (CWE-78) has been found to exist in the `wrangler pages deploy` command. The issue occurs because the `--commit-hash` parameter is passed directly to a shell command without proper validation or sanitization, allowing an attacker with control of `--commit-hash` to execute arbitrary commands on the system running Wrangler. Root causeThe commitHash variable, derived from user input via the --commit-hash CLI argument, is interpolated directly into a shell command using template literals (e.g., execSync(`git show -s --format=%B ${commitHash}`)). Shell metacharacters are interpreted by the shell, enabling command execution. ImpactThis vulnerability is generally hard to exploit, as it requires --commit-hash to be attacker controlled. The vulnerability primarily affects CI/CD environments where `wrangler pages deploy` is used in automated pipelines and the --commit-hash parameter is populated from external, potentially untrusted sources. An attacker could exploit this to: * Run any shell command. * Exfiltrate environment variables. * Compromise the CI runner to install backdoors or modify build artifacts. Credits Disclosed responsibly by kny4hacker. Mitigation * Wrangler v4 users are requested to upgrade to Wrangler v4.59.1 or higher. * Wrangler v3 users are requested to upgrade to Wrangler v3.114.17 or higher. * Users on Wrangler v2 (EOL) should upgrade to a supported major version.
Risk Information
cvss4
Base: 7.7
Severity: LOW
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Description
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
Risk Information
cvss3
Base: 8.2
Severity: LOW
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Description
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle VM VirtualBox accessible data as well as unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L).
Risk Information
cvss3
Base: 8.1
Severity: LOW
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L
Description
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
Risk Information
cvss3
Base: 8.2
Severity: LOW
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Description
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
Risk Information
cvss3
Base: 8.2
Severity: LOW
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Access Data Using Our API
Get company history
curl -i -X GET 'https://api.rankiteo.com/underwriter-getcompany-history?linkedin_id=bank-of-america-merrill-lynch' -H 'apikey: YOUR_API_KEY_HERE'
RapidWhat Do We Measure ?
Incident
Finding
Grade
Digital Assets
Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.
These are some of the factors we use to calculate the overall score:
Network Security
Identify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.
SBOM (Software Bill of Materials)
Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.
CMDB (Configuration Management Database)
Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.
Threat Intelligence
Leverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.
Rankiteo is a unified scoring and risk platform that analyzes billions of signals weekly to help organizations gain faster, more actionable insights into emerging threats. Empowering teams to outpace adversaries and reduce exposure.
