BAML
Company Details
Linkedin ID:
bank-of-america-merrill-lynch
Website:
Employees number:
16,629
Number of followers:
378,410
NAICS:
52
Industry Type:
Homepage:
bofaml.com
IP Addresses:
0
Company ID:
BAN_2040524
Scan Status:
In-progress
Internal validation & live display
Multiple badges & continuous verification
Faster underwriting decisions
Bank of America Merrill Lynch Vendor Cyber Rating & Cyber Score
bofaml.comFrom local communities to global markets, we are dedicated to shaping the future responsibly and helping clients thrive in a changing world. “Bank of America Merrill Lynch” is the marketing name for the global banking and global markets businesses of Bank of America Corporation. Bank of America is a marketing name for the Retirement Services business of Bank of America Corporation. Lending, derivatives, and other commercial banking activities are performed globally by banking affiliates of Bank of America Corporation, including Bank of America, N.A., Member FDIC. Securities, strategic advisory, and other investment banking activities are performed globally by investment banking affiliates of Bank of America Corporation (“Investment Banking Affiliates”), including, in the United States, BofA Securities, Inc., Merrill Lynch, Pierce, Fenner & Smith Incorporated, and Merrill Lynch Professional Clearing Corp., all of which are registered broker-dealers and Members of SIPC, and in other jurisdictions, by locally registered entities. BofA Securities, Inc., Merrill Lynch, Pierce, Fenner & Smith Incorporated and Merrill Lynch Professional Clearing Corp. are registered as futures commission merchants with the CFTC and are members of the NFA. Investment products: Are Not FDIC Insured May Lose Value Are Not Bank Guaranteed Any opinions, views, statements, estimates or projections (“posts”) posted on this web page are solely those of the individual author(s). As such, posts by an employee of BofAML or any of its affiliates are solely those of such employee or agent and do not necessarily reflect the views of BofAML. BofAML is not responsible for the content, or output of external websites. For Terms and Conditions and Disclaimers, please visit go.bofaml.com/social. Bank of America LinkedIn Community Guidelines can be found at: http://about.bankofamerica.com/en-us/social-media/linkedin-community-guidelines.html
Bank of America Merrill Lynch A.I CyberSecurity Scoring
BAML Risk Score (AI oriented)Between 750 and 799
BAML
Updated:
- Powered by our proprietary A.I cyber incident model
- Insurance preferes TPRM score to calculate premium
BAML Global Score (TPRM)XXXX
BAML
- Instant access to detailed risk factors
- Benchmark vs. industry & size peers
- Vulnerabilities
- Findings
BAML Company CyberSecurity News & History
Past Incidents
5
Attack Types
3
Major U.S. Bank: New Malware Targets 200,000+ U.S. Bank Employees to Steal Login Credentials
Cyber Attack
Rankiteo Explanation
Attack with significant impact with internal employee data leaks
Description: Sophisticated Keylogger Attack Targets Major U.S. Bank’s Employee Store, Exposing 200,000 to Credential Theft Cybersecurity researchers have identified a highly targeted keylogger attack on the employee store of one of America’s largest banks, compromising sensitive data for over 200,000 employees. The malware intercepted all form inputs including login credentials, payment card details, and personal information raising concerns about potential lateral movement into the bank’s internal systems. The attack exploited a critical gap in enterprise security: employee-facing ecommerce platforms, which often fall outside standard security audits despite handling corporate credentials. Since bank employees frequently have elevated access to financial systems, such platforms become prime targets for threat actors seeking initial footholds in banking infrastructure. The malware used a two-stage loader to evade detection. The first stage employed character code obfuscation to verify users had reached checkout pages before fetching a secondary harvesting script from *js-csp.com/getInjector/*. The second stage systematically extracted form data including input fields, dropdown menus, and text areas before exfiltrating stolen credentials via image beacon requests to bypass security controls. At the time of discovery, only 1 of 97 security vendors on VirusTotal flagged the malicious infrastructure, highlighting a significant detection gap for ecommerce-specific threats. The attack pattern mirrors previous campaigns, including one targeting the Green Bay Packers, and marks the fifth *getInjector* campaign detected in the past year. The *js-csp.com* domain was registered in late December 2025, with the compromise identified within weeks of deployment. The bank’s response was delayed due to the absence of a *security.txt* file, a standard channel for responsible disclosure. Despite researchers’ attempts to notify the bank via email and LinkedIn, the lack of formal security contacts hindered remediation efforts. The incident underscores the need for organizations to monitor client-side scripts, include internal ecommerce platforms in security audits, and deploy specialized threat detection for this emerging attack surface.
Bank of America
Breach
Rankiteo Explanation
Attack limited on finance or reputation
Description: The Maine Office of the Attorney General reported a data breach related to Bank of America on March 3, 2025, involving an inadvertent disclosure that occurred on February 18, 2025. One individual was affected, and the compromised information included personal details such as names and Social Security numbers. Bank of America offered a complimentary two-year identity theft protection service by Experian.
Bank of America
Breach
Rankiteo Explanation
Attack with significant impact with customers data leaks
Description: The Maine Office of the Attorney General disclosed a data breach affecting Bank of America, detected on October 1, 2024, and reported on January 3, 2025. The incident involved unauthorized access to sensitive personal information, compromising 414 individuals, including at least one Maine resident. While the exact nature of the exposed data was not fully detailed, the breach was severe enough to warrant 24 months of free identity theft protection services via Experian, suggesting the exposure of personally identifiable information (PII) that could facilitate fraud or identity theft. The breach highlights vulnerabilities in Bank of America’s data security measures, raising concerns over potential financial fraud, reputational damage, and regulatory scrutiny. Although the scale (414 individuals) is relatively contained compared to mass breaches, the provision of long-term identity protection indicates a high-risk exposure likely involving financial or identity-related data (e.g., Social Security numbers, account details, or addresses). The incident underscores the persistent threat of cyber intrusions targeting financial institutions, where even limited breaches can have cascading consequences for affected individuals, including phishing attacks, unauthorized transactions, or credit fraud.
Merrill, A Bank of America Company
Breach
Rankiteo Explanation
Attack with significant impact with internal employee data leaks
Description: On April 16, 2024, the Maine Office of the Attorney General disclosed that Bank of America suffered an inadvertent data breach caused by a Merrill employee’s email error, leading to the unauthorized exposure of customer information. The incident impacted 2,676 individuals, including 18 Maine residents, though the exact nature of the exposed data (e.g., financial details, personal identifiers) was not fully specified. In response, Bank of America offered affected individuals two years of complimentary identity theft protection via Experian IdentityWorks™ to mitigate potential risks such as fraud or identity misuse. The breach did not involve malicious cyber activity like hacking or ransomware but stemmed from human error, highlighting vulnerabilities in internal data-handling protocols. While no evidence suggested exploitation of the exposed data, the incident underscored the reputational and operational risks associated with employee-driven data leaks, particularly for a major financial institution. The breach’s scope though limited in scale raised concerns about compliance with data protection regulations and the bank’s ability to safeguard sensitive customer information.
Bank of America
Data Leak
Rankiteo Explanation
Attack with significant impact with internal employee data leaks
Description: Business clients applying for Paycheck Protection Program (PPP) loans with Bank of America have had their personal and business information exposed in a data breach. The data breach occurred on April 22 as Bank of America uploaded customers’ PPP loan applications to the Small Business Administration’s (SBA) online testing system, which allowed lenders to test application submissions. During the testing process, Application information was potentially visible to other lenders and their third-party vendors. The exposed data included both business and clients’ personal information. The affected business data may include business names, addresses, and tax identification numbers. Affected personal data may include names, addresses, Social Security numbers, phone numbers, email addresses, and citizenship information.
BAML Company Scoring based on AI Models
Cyber Incidents Likelihood 3 - 6 - 9 months
A.I Risk Score Likelihood 3 - 6 - 9 months
Underwriter Stats for BAML
Incidents vs Financial Services Industry Average (This Year)
No incidents recorded for Bank of America Merrill Lynch in 2026.
Incidents vs All-Companies Average (This Year)
No incidents recorded for Bank of America Merrill Lynch in 2026.
Incident Types BAML vs Financial Services Industry Avg (This Year)
No incidents recorded for Bank of America Merrill Lynch in 2026.
Incident History — BAML (X = Date, Y = Severity)
BAML cyber incidents detection timeline including parent company and subsidiaries
BAML Company Subsidiaries
From local communities to global markets, we are dedicated to shaping the future responsibly and helping clients thrive in a changing world. “Bank of America Merrill Lynch” is the marketing name for the global banking and global markets businesses of Bank of America Corporation. Bank of America is a marketing name for the Retirement Services business of Bank of America Corporation. Lending, derivatives, and other commercial banking activities are performed globally by banking affiliates of Bank of America Corporation, including Bank of America, N.A., Member FDIC. Securities, strategic advisory, and other investment banking activities are performed globally by investment banking affiliates of Bank of America Corporation (“Investment Banking Affiliates”), including, in the United States, BofA Securities, Inc., Merrill Lynch, Pierce, Fenner & Smith Incorporated, and Merrill Lynch Professional Clearing Corp., all of which are registered broker-dealers and Members of SIPC, and in other jurisdictions, by locally registered entities. BofA Securities, Inc., Merrill Lynch, Pierce, Fenner & Smith Incorporated and Merrill Lynch Professional Clearing Corp. are registered as futures commission merchants with the CFTC and are members of the NFA. Investment products: Are Not FDIC Insured May Lose Value Are Not Bank Guaranteed Any opinions, views, statements, estimates or projections (“posts”) posted on this web page are solely those of the individual author(s). As such, posts by an employee of BofAML or any of its affiliates are solely those of such employee or agent and do not necessarily reflect the views of BofAML. BofAML is not responsible for the content, or output of external websites. For Terms and Conditions and Disclaimers, please visit go.bofaml.com/social. Bank of America LinkedIn Community Guidelines can be found at: http://about.bankofamerica.com/en-us/social-media/linkedin-community-guidelines.html
Loading...
BAML Similar Companies
Westpac Group
From rescue helicopters to signing the Equator Principles, from paying super during parental leave to adding 'Touch ID' biometric technology to our banking apps and being first on the scene with a helping hand in times of crisis... we have a proud history of stepping up to be first for our customer
Merrill Lynch
Founded in 1914, Merrill is one of the largest wealth management businesses in the world. Merrill financial advisors combine financial knowledge and experience with a deep understanding of their clients’ needs to help their clients pursue the lives they want. With a deep commitment to placing their
JPMorganChase
With a history tracing its roots to 1799 in New York City, JPMorganChase is one of the world's oldest, largest, and best-known financial institutions—carrying forth the innovative spirit of our heritage firms in global operations across 100 markets. We serve millions of customers and many of the w
Nationale-Nederlanden
NN Group is an international financial services company, active in 10 countries, with a strong presence in a number of European countries and Japan. Our roots lie in the Netherlands, with a rich history of more than 175 years. With our 15,000 employees, NN Group provides retirement services, pensio
First American Financial Corporation is a premier provider of title, settlement and risk solutions for real estate transactions. With its combination of financial strength and stability built over more than 130 years, innovative proprietary technologies, and unmatched data assets, the company is lea
J.P. Morgan
J.P. Morgan is a leader in financial services, offering solutions to clients in more than 100 countries with one of the most comprehensive global product platforms available. We have been helping our clients to do business and manage their wealth for more than 200 years. Our business has been built
Prudential Financial
Prudential Financial (NYSE:PRU) was founded on the belief that financial security should be within reach for everyone, and for over 140 years, we have helped our customers reach their potential and tackle life's challenges for now and future generations to come. Today, we are one of the world’s larg
PT. Pegadaian
PT Pegadaian didirikan di kota Sukabumi, Jawa Barat pada 1 April 1901. Tak hanya bergerak di Industri Gadai, Pegadaian juga memiliki ragam produk dan layanan seperti investasi berbasis emas yang dapat dimiliki oleh masyarakat dengan cara yang mudah, diantaranya Tabungan Emas, Cicil Emas dan Arisan
UBS
From gaining new experiences in different roles to acquiring fresh knowledge and skills – at UBS we believe that you should never stop growing and learning because life never stops teaching. We know that it's our people – with their unique backgrounds, skills, experience levels and interests – who d
.png)
BAML CyberSecurity News
March 19, 2026 07:00 AM
The best high-yield savings accounts of March 2026
Editor's Note: APYs listed in this article are up-to-date as of the time of publication. CNBC Select will update as changes are made public.
January 28, 2026 08:00 AM
SPA Names Raj Badhwar as CIO
Systems Planning & Analysis has appointed Raj Badhwar as its chief information officer, placing a longtime cybersecurity and technology...
September 18, 2025 07:00 AM
Hexagon’s Octave spin-off brings veteran team to tackle industrial complexity with data, AI
Octave, the proposed software spin-off from Hexagon AB, announced its executive leadership team, uniting visionary leaders,...
August 11, 2025 07:00 AM
48 CIOs On the Move
This month, we're highlighting 48 CIOs, CTOs, and CISOs taking on leadership roles in industries from healthcare to finance to technology.
July 30, 2025 07:00 AM
Why Booz Allen’s CTO used generative AI to make a deepfake video of himself
Booz Allen Hamilton's CTO, Bill Vass, made a deepfake video of himself to promote greater worker skepticism of video and audio content and...
May 03, 2025 08:25 PM
Bank of America confirms data breach compromised customer data in November 2023
Who: Bank of America warned customers they may have been affected by a November 2023 data breach that occurred as a result of a cybersecurity incident...
May 01, 2025 07:00 AM
Bankers fear relay-fraud comeback and Synapse issues in May
Fintechs acquiring banks are trending once again, as are the problematic levels of relay fraud, bots conducting cyber attacks against banks...
April 10, 2025 07:00 AM
Marquis Who's Who Honors Parthasarathi Chakraborty for Excellence in Technology
Parthasarathi Chakraborty is a renowned leader with nearly 30 years of experience in cybersecurity defense and engineering.
February 14, 2025 08:00 AM
Merrill Edge Safety Review: How Secure is Your Information?
Launched by Bank of America, Merrill Edge is a secure investment app with backing from one of the largest banks in the United States.
Frequently Asked Questions
Explore insights on cybersecurity incidents, risk posture, and Rankiteo's assessments.
BAML CyberSecurity History Information
Official Website of Bank of America Merrill Lynch
The official website of Bank of America Merrill Lynch is http://www.bofaml.com.
Bank of America Merrill Lynch’s AI-Generated Cybersecurity Score
According to Rankiteo, Bank of America Merrill Lynch’s AI-generated cybersecurity score is 787, reflecting their Fair security posture.
How many security badges does Bank of America Merrill Lynch’ have ?
According to Rankiteo, Bank of America Merrill Lynch currently holds 0 security badges, indicating that no recognized compliance certifications are currently verified for the organization.
Has Bank of America Merrill Lynch been affected by any supply chain cyber incidents ?
According to Rankiteo, Bank of America Merrill Lynch has not been affected by any supply chain cyber incidents, and no incident IDs are currently listed for the organization.
Does Bank of America Merrill Lynch have SOC 2 Type 1 certification ?
According to Rankiteo, Bank of America Merrill Lynch is not certified under SOC 2 Type 1.
Does Bank of America Merrill Lynch have SOC 2 Type 2 certification ?
According to Rankiteo, Bank of America Merrill Lynch does not hold a SOC 2 Type 2 certification.
Does Bank of America Merrill Lynch comply with GDPR ?
According to Rankiteo, Bank of America Merrill Lynch is not listed as GDPR compliant.
Does Bank of America Merrill Lynch have PCI DSS certification ?
According to Rankiteo, Bank of America Merrill Lynch does not currently maintain PCI DSS compliance.
Does Bank of America Merrill Lynch comply with HIPAA ?
According to Rankiteo, Bank of America Merrill Lynch is not compliant with HIPAA regulations.
Does Bank of America Merrill Lynch have ISO 27001 certification ?
According to Rankiteo,Bank of America Merrill Lynch is not certified under ISO 27001, indicating the absence of a formally recognized information security management framework.
Industry Classification of Bank of America Merrill Lynch
Bank of America Merrill Lynch operates primarily in the Financial Services industry.
Number of Employees at Bank of America Merrill Lynch
Bank of America Merrill Lynch employs approximately 16,629 people worldwide.
Subsidiaries Owned by Bank of America Merrill Lynch
Bank of America Merrill Lynch presently has no subsidiaries across any sectors.
Bank of America Merrill Lynch’s LinkedIn Followers
Bank of America Merrill Lynch’s official LinkedIn profile has approximately 378,410 followers.
NAICS Classification of Bank of America Merrill Lynch
Bank of America Merrill Lynch is classified under the NAICS code 52, which corresponds to Finance and Insurance.
Bank of America Merrill Lynch’s Presence on Crunchbase
No, Bank of America Merrill Lynch does not have a profile on Crunchbase.
Bank of America Merrill Lynch’s Presence on LinkedIn
Yes, Bank of America Merrill Lynch maintains an official LinkedIn profile, which is actively utilized for branding and talent engagement, which can be accessed here: https://www.linkedin.com/company/bank-of-america-merrill-lynch.
Cybersecurity Incidents Involving Bank of America Merrill Lynch
As of April 02, 2026, Rankiteo reports that Bank of America Merrill Lynch has experienced 5 cybersecurity incidents.
Number of Peer and Competitor Companies
Bank of America Merrill Lynch has an estimated 31,537 peer or competitor companies worldwide.
What types of cybersecurity incidents have occurred at Bank of America Merrill Lynch ?
Incident Types: The types of cybersecurity incidents that have occurred include Breach, Cyber Attack and Data Leak.
How does Bank of America Merrill Lynch detect and respond to cybersecurity incidents ?
Detection and Response: The company detects and responds to cybersecurity incidents through an third party assistance with experian, and remediation measures with complimentary two-year identity theft protection service, and incident response plan activated with likely (standard protocol for data breaches), and third party assistance with experian (identityworks™ services), and remediation measures with offering 2-year complimentary identity theft protection (experian identityworks™), and communication strategy with notification to affected individuals via maine ag report, and third party assistance with experian (identity theft protection), and communication strategy with delayed due to absence of security.txt file..
Incident Details
Can you provide details on each incident ?
Title: Bank of America PPP Loan Data Breach
Description: Business clients applying for Paycheck Protection Program (PPP) loans with Bank of America have had their personal and business information exposed in a data breach.
Date Detected: April 22, 2020
Type: Data Breach
Attack Vector: Improper Data Handling
Vulnerability Exploited: Improper Data Handling
Title: Bank of America Data Breach
Description: The Maine Office of the Attorney General reported a data breach related to Bank of America on March 3, 2025, involving an inadvertent disclosure that occurred on February 18, 2025. One individual was affected, and the compromised information included personal details such as names and Social Security numbers. Bank of America offered a complimentary two-year identity theft protection service by Experian.
Date Detected: 2025-02-18
Date Publicly Disclosed: 2025-03-03
Type: Data Breach
Attack Vector: Inadvertent Disclosure
Title: Bank of America Inadvertent Disclosure of Customer Information via Merrill Employee Email Error
Description: The Maine Office of the Attorney General reported that Bank of America experienced an inadvertent disclosure of customer information on April 16, 2024, due to a Merrill employee email error, affecting a total of 2,676 individuals, including 18 Maine residents. Bank of America is offering a complimentary two-year membership in identity theft protection services through Experian IdentityWorks™.
Date Detected: 2024-04-16
Date Publicly Disclosed: 2024-04-16
Type: Data Breach (Inadvertent Disclosure)
Attack Vector: Human Error (Email Misconfiguration)
Title: Bank of America Data Breach (2024)
Description: The Maine Office of the Attorney General reported a data breach involving Bank of America. The breach occurred on October 1, 2024, affecting 414 individuals, including 1 resident of Maine. Unauthorized access was detected, and identity theft protection services (24 months via Experian) were offered to affected individuals.
Date Detected: 2024-10-01
Date Publicly Disclosed: 2025-01-03
Type: Data Breach
Title: Sophisticated Keylogger Attack Targets Major U.S. Bank’s Employee Store, Exposing 200,000 to Credential Theft
Description: Cybersecurity researchers have identified a highly targeted keylogger attack on the employee store of one of America’s largest banks, compromising sensitive data for over 200,000 employees. The malware intercepted all form inputs including login credentials, payment card details, and personal information, raising concerns about potential lateral movement into the bank’s internal systems. The attack exploited a critical gap in enterprise security: employee-facing ecommerce platforms, which often fall outside standard security audits despite handling corporate credentials. The malware used a two-stage loader to evade detection, systematically extracting form data before exfiltrating stolen credentials via image beacon requests to bypass security controls.
Type: Keylogger Attack
Attack Vector: Malicious script injection (client-side)
Vulnerability Exploited: Lack of security audits for employee-facing ecommerce platforms
Motivation: Credential theft for potential lateral movement into banking infrastructure
What are the most common types of attacks the company has faced ?
Common Attack Types: The most common types of attacks the company has faced is Breach.
How does the company identify the attack vectors used in incidents ?
Identification of Attack Vectors: The company identifies the attack vectors used in incidents through Employee-facing ecommerce platform.
Impact of the Incidents
What was the impact of each incident ?
Incident : Data Breach BAN2212291222
Data Compromised: Business names, Addresses, Tax identification numbers, Names, Social security numbers, Phone numbers, Email addresses, Citizenship information
Incident : Data Breach BAN832072725
Data Compromised: Names, Social security numbers
Identity Theft Risk: High
Incident : Data Breach (Inadvertent Disclosure) BAN721082025
Data Compromised: Customer information
Brand Reputation Impact: Potential (Mitigated by Identity Theft Protection Offer)
Identity Theft Risk: High (Mitigated by Experian IdentityWorks™ Offer)
Incident : Data Breach BAN030091825
Identity Theft Risk: True
Incident : Keylogger Attack BAN1769475353
Data Compromised: Login credentials, payment card details, personal information
Systems Affected: Employee-facing ecommerce platform
Operational Impact: Potential lateral movement into internal banking systems
Identity Theft Risk: High
Payment Information Risk: High
What types of data are most commonly compromised in incidents ?
Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Business Names, Addresses, Tax Identification Numbers, Names, Social Security Numbers, Phone Numbers, Email Addresses, Citizenship Information, , Personal Information, , Customer Information (Details Unspecified), Login Credentials, Payment Card Details, Personal Information and .
Which entities were affected by each incident ?
Incident : Data Breach BAN2212291222
Entity Name: Bank of America
Entity Type: Financial Institution
Industry: Banking
Incident : Data Breach BAN832072725
Entity Name: Bank of America
Entity Type: Financial Institution
Industry: Banking
Customers Affected: 1
Incident : Data Breach (Inadvertent Disclosure) BAN721082025
Entity Name: Bank of America (via Merrill)
Entity Type: Financial Institution
Industry: Banking/Financial Services
Location: United States (Maine residents among affected)
Size: Large (Multinational)
Customers Affected: 2,676 (including 18 Maine residents)
Incident : Data Breach BAN030091825
Entity Name: Bank of America
Entity Type: Financial Institution
Industry: Banking/Financial Services
Location: United States
Customers Affected: 414
Incident : Keylogger Attack BAN1769475353
Entity Name: Major U.S. Bank (unnamed)
Entity Type: Bank
Industry: Financial Services
Location: United States
Customers Affected: 200,000 employees
Response to the Incidents
What measures were taken in response to each incident ?
Incident : Data Breach BAN832072725
Third Party Assistance: Experian.
Remediation Measures: Complimentary two-year identity theft protection service
Incident : Data Breach (Inadvertent Disclosure) BAN721082025
Incident Response Plan Activated: Likely (Standard Protocol for Data Breaches)
Third Party Assistance: Experian (Identityworks™ Services).
Remediation Measures: Offering 2-year complimentary identity theft protection (Experian IdentityWorks™)
Communication Strategy: Notification to affected individuals via Maine AG report
Incident : Data Breach BAN030091825
Third Party Assistance: Experian (Identity Theft Protection).
Incident : Keylogger Attack BAN1769475353
Communication Strategy: Delayed due to absence of security.txt file
What is the company's incident response plan?
Incident Response Plan: The company's incident response plan is described as Likely (Standard Protocol for Data Breaches).
How does the company involve third-party assistance in incident response ?
Third-Party Assistance: The company involves third-party assistance in incident response through Experian, , Experian (IdentityWorks™ Services), , Experian (Identity Theft Protection), .
Data Breach Information
What type of data was compromised in each breach ?
Incident : Data Breach BAN2212291222
Type of Data Compromised: Business names, Addresses, Tax identification numbers, Names, Social security numbers, Phone numbers, Email addresses, Citizenship information
Sensitivity of Data: High
Incident : Data Breach BAN832072725
Type of Data Compromised: Personal information
Number of Records Exposed: 1
Sensitivity of Data: High
Personally Identifiable Information: NamesSocial Security numbers
Incident : Data Breach (Inadvertent Disclosure) BAN721082025
Type of Data Compromised: Customer Information (Details Unspecified)
Number of Records Exposed: 2,676
Sensitivity of Data: Moderate to High (PII likely included)
Personally Identifiable Information: Likely (Given Identity Theft Protection Offer)
Incident : Data Breach BAN030091825
Number of Records Exposed: 414
Incident : Keylogger Attack BAN1769475353
Type of Data Compromised: Login credentials, Payment card details, Personal information
Number of Records Exposed: 200,000
Sensitivity of Data: High
Data Exfiltration: Yes (via image beacon requests)
Personally Identifiable Information: Yes
What measures does the company take to prevent data exfiltration ?
Prevention of Data Exfiltration: The company takes the following measures to prevent data exfiltration: Complimentary two-year identity theft protection service, , Offering 2-year complimentary identity theft protection (Experian IdentityWorks™), .
Regulatory Compliance
Were there any regulatory violations and fines imposed for each incident ?
Incident : Data Breach (Inadvertent Disclosure) BAN721082025
Regulatory Notifications: Maine Office of the Attorney General
Incident : Data Breach BAN030091825
Regulatory Notifications: Maine Office of the Attorney General
Lessons Learned and Recommendations
What lessons were learned from each incident ?
Incident : Keylogger Attack BAN1769475353
Lessons Learned: Organizations need to monitor client-side scripts, include internal ecommerce platforms in security audits, and deploy specialized threat detection for this emerging attack surface. The absence of a security.txt file hindered responsible disclosure and remediation efforts.
What recommendations were made to prevent future incidents ?
Incident : Keylogger Attack BAN1769475353
Recommendations: Monitor client-side scripts for malicious activity, Include employee-facing ecommerce platforms in security audits, Deploy specialized threat detection for ecommerce-specific threats, Implement a security.txt file for responsible disclosureMonitor client-side scripts for malicious activity, Include employee-facing ecommerce platforms in security audits, Deploy specialized threat detection for ecommerce-specific threats, Implement a security.txt file for responsible disclosureMonitor client-side scripts for malicious activity, Include employee-facing ecommerce platforms in security audits, Deploy specialized threat detection for ecommerce-specific threats, Implement a security.txt file for responsible disclosureMonitor client-side scripts for malicious activity, Include employee-facing ecommerce platforms in security audits, Deploy specialized threat detection for ecommerce-specific threats, Implement a security.txt file for responsible disclosure
What are the key lessons learned from past incidents ?
Key Lessons Learned: The key lessons learned from past incidents are Organizations need to monitor client-side scripts, include internal ecommerce platforms in security audits, and deploy specialized threat detection for this emerging attack surface. The absence of a security.txt file hindered responsible disclosure and remediation efforts.
References
Where can I find more information about each incident ?
Incident : Data Breach BAN832072725
Source: Maine Office of the Attorney General
Date Accessed: 2025-03-03
Incident : Data Breach (Inadvertent Disclosure) BAN721082025
Source: Maine Office of the Attorney General
Date Accessed: 2024-04-16
Incident : Data Breach BAN030091825
Source: Maine Office of the Attorney General
Date Accessed: 2025-01-03
Incident : Keylogger Attack BAN1769475353
Source: Cybersecurity researchers
Where can stakeholders find additional resources on cybersecurity best practices ?
Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: Maine Office of the Attorney GeneralDate Accessed: 2025-03-03, and Source: Maine Office of the Attorney GeneralDate Accessed: 2024-04-16, and Source: Maine Office of the Attorney GeneralDate Accessed: 2025-01-03, and Source: Cybersecurity researchers.
Investigation Status
What is the current status of the investigation for each incident ?
Incident : Data Breach (Inadvertent Disclosure) BAN721082025
Investigation Status: Disclosed (No Further Details)
How does the company communicate the status of incident investigations to stakeholders ?
Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through Notification To Affected Individuals Via Maine Ag Report and Delayed due to absence of security.txt file.
Stakeholder and Customer Advisories
Were there any advisories issued to stakeholders or customers for each incident ?
Incident : Data Breach (Inadvertent Disclosure) BAN721082025
Customer Advisories: Offer of 2-year Experian IdentityWorks™ membership
Incident : Data Breach BAN030091825
Customer Advisories: Identity theft protection services (24 months via Experian) offered to affected individuals
What advisories does the company provide to stakeholders and customers following an incident ?
Advisories Provided: The company provides the following advisories to stakeholders and customers following an incident: were Offer Of 2-Year Experian Identityworks™ Membership, , Identity Theft Protection Services (24 Months Via Experian) Offered To Affected Individuals and .
Initial Access Broker
How did the initial access broker gain entry for each incident ?
Incident : Keylogger Attack BAN1769475353
Entry Point: Employee-facing ecommerce platform
High Value Targets: Bank employees with elevated access to financial systems
Data Sold on Dark Web: Bank employees with elevated access to financial systems
Post-Incident Analysis
What were the root causes and corrective actions taken for each incident ?
Incident : Data Breach (Inadvertent Disclosure) BAN721082025
Root Causes: Human Error (Merrill Employee Email Misconfiguration),
Incident : Keylogger Attack BAN1769475353
Root Causes: Lack Of Security Audits For Employee-Facing Ecommerce Platforms, Absence Of Security.Txt File For Responsible Disclosure, Detection Gap For Ecommerce-Specific Threats,
What is the company's process for conducting post-incident analysis ?
Post-Incident Analysis Process: The company's process for conducting post-incident analysis is described as Experian, , Experian (Identityworks™ Services), , Experian (Identity Theft Protection), .
Additional Questions
Incident Details
What was the most recent incident detected ?
Most Recent Incident Detected: The most recent incident detected was on April 22, 2020.
What was the most recent incident publicly disclosed ?
Most Recent Incident Publicly Disclosed: The most recent incident publicly disclosed was on 2025-01-03.
Impact of the Incidents
What was the most significant data compromised in an incident ?
Most Significant Data Compromised: The most significant data compromised in an incident were Business names, Addresses, Tax identification numbers, Names, Social Security numbers, Phone numbers, Email addresses, Citizenship information, , Names, Social Security numbers, , Customer Information, , , Login credentials, payment card details and personal information.
Response to the Incidents
What third-party assistance was involved in the most recent incident ?
Third-Party Assistance in Most Recent Incident: The third-party assistance involved in the most recent incident was experian, , experian (identityworks™ services), , experian (identity theft protection), .
Data Breach Information
What was the most sensitive data compromised in a breach ?
Most Sensitive Data Compromised: The most sensitive data compromised in a breach were Tax identification numbers, Phone numbers, Addresses, Business names, Names, Citizenship information, Login credentials, payment card details, personal information, Social Security numbers, Email addresses and Customer Information.
What was the number of records exposed in the most significant breach ?
Number of Records Exposed in Most Significant Breach: The number of records exposed in the most significant breach was 203.1K.
Lessons Learned and Recommendations
What was the most significant lesson learned from past incidents ?
Most Significant Lesson Learned: The most significant lesson learned from past incidents was Organizations need to monitor client-side scripts, include internal ecommerce platforms in security audits, and deploy specialized threat detection for this emerging attack surface. The absence of a security.txt file hindered responsible disclosure and remediation efforts.
What was the most significant recommendation implemented to improve cybersecurity ?
Most Significant Recommendation Implemented: The most significant recommendation implemented to improve cybersecurity was Monitor client-side scripts for malicious activity, Deploy specialized threat detection for ecommerce-specific threats, Implement a security.txt file for responsible disclosure and Include employee-facing ecommerce platforms in security audits.
References
What is the most recent source of information about an incident ?
Most Recent Source: The most recent source of information about an incident are Cybersecurity researchers and Maine Office of the Attorney General.
Investigation Status
What is the current status of the most recent investigation ?
Current Status of Most Recent Investigation: The current status of the most recent investigation is Disclosed (No Further Details).
Stakeholder and Customer Advisories
What was the most recent customer advisory issued ?
Most Recent Customer Advisory: The most recent customer advisory issued were an Offer of 2-year Experian IdentityWorks™ membership and Identity theft protection services (24 months via Experian) offered to affected individuals.
Initial Access Broker
What was the most recent entry point used by an initial access broker ?
Most Recent Entry Point: The most recent entry point used by an initial access broker was an Employee-facing ecommerce platform.
Post-Incident Analysis
What was the most significant root cause identified in post-incident analysis ?
Most Significant Root Cause: The most significant root cause identified in post-incident analysis was Human Error (Merrill Employee Email Misconfiguration), Lack of security audits for employee-facing ecommerce platformsAbsence of security.txt file for responsible disclosureDetection gap for ecommerce-specific threats.
.png)
Latest Global CVEs (Not Company-Specific)
Description
A vulnerability was found in Nothings stb up to 1.26. Impacted is the function stbtt_InitFont_internal in the library stb_truetype.h of the component TTF File Handler. Performing a manipulation results in out-of-bounds read. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Risk Information
cvss2
Base: 5.0
Severity: LOW
AV:N/AC:L/Au:N/C:N/I:N/A:P
cvss3
Base: 4.3
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
cvss4
Base: 5.3
Severity: LOW
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Description
V-SFT versions 6.2.10.0 and prior contain an out-of-bounds read in VS6ComFile!get_macro_mem_COM. Opening a crafted V7 file may lead to information disclosure from the affected product.
Risk Information
cvss3
Base: 7.8
Severity: LOW
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
cvss4
Base: 8.4
Severity: LOW
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Description
V-SFT versions 6.2.10.0 and prior contain a stack-based buffer overflow in VS6ComFile!CSaveData::_conv_AnimationItem. Opening a crafted V7 file may lead to arbitrary code execution on the affected product.
Risk Information
cvss3
Base: 7.8
Severity: LOW
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
cvss4
Base: 8.4
Severity: LOW
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Description
V-SFT versions 6.2.10.0 and prior contain an out-of-bounds read vulnerability in VS6MemInIF!set_temp_type_default. Opening a crafted V7 file may lead to information disclosure from the affected product.
Risk Information
cvss3
Base: 7.8
Severity: LOW
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
cvss4
Base: 8.4
Severity: LOW
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Description
V-SFT versions 6.2.10.0 and prior contain an out-of-bounds read vulnerability in VS6ComFile!load_link_inf. Opening a crafted V7 file may lead to information disclosure from the affected product.
Risk Information
cvss3
Base: 7.8
Severity: LOW
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
cvss4
Base: 8.4
Severity: LOW
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Access Data Using Our API
Get company history
curl -i -X GET 'https://api.rankiteo.com/underwriter-getcompany-history?linkedin_id=bank-of-america-merrill-lynch' -H 'apikey: YOUR_API_KEY_HERE'
RapidWhat Do We Measure ?
Incident
Finding
Grade
Digital Assets
Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.
These are some of the factors we use to calculate the overall score:
Network Security
Identify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.
SBOM (Software Bill of Materials)
Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.
CMDB (Configuration Management Database)
Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.
Threat Intelligence
Leverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.
Rankiteo is a unified scoring and risk platform that analyzes billions of signals weekly to help organizations gain faster, more actionable insights into emerging threats. Empowering teams to outpace adversaries and reduce exposure.
