Merrill Lynch
Company Details
Linkedin ID:
merrilllynch
Website:
Employees number:
34,603
Number of followers:
748,637
NAICS:
52
Industry Type:
Homepage:
ml.com
IP Addresses:
0
Company ID:
MER_1750983
Scan Status:
In-progress
Internal validation & live display
Multiple badges & continuous verification
Faster underwriting decisions
Merrill Lynch Vendor Cyber Rating & Cyber Score
ml.comFounded in 1914, Merrill is one of the largest wealth management businesses in the world. Merrill financial advisors combine financial knowledge and experience with a deep understanding of their clients’ needs to help their clients pursue the lives they want. With a deep commitment to placing their clients' interests first, Merrill financial advisors draw upon the investment insights of Merrill and the banking insights of Bank of America to unlock opportunities tailored to their clients’ needs in many areas of their financial lives. The strategies our financial advisors offer go beyond investment management to include college savings strategies, retirement planning, eldercare, philanthropy, estate planning services, small business services, and access to cash management & banking strategies. Any opinions, views, statements, estimates or projections ("posts") posted on this web page are solely those of the author(s). Merrill Lynch Global Wealth Management is part of Bank of America Corporation's Global Wealth & Investment Management business. Additional Terms, Conditions & Disclaimers found here: https://www.ml.com/social-media/merrill-lynch-on-twitter.html Disclaimer The site is maintained by a third party that has no affiliation with Merrill Lynch, Pierce, Fenner & Smith Incorporated ("MLPF&S" or "Merrill"). The recommendations posted to this page by or about Merrill employees, are not endorsed by, and may not represent the views. This material is not intended to constitute a recommendation, offer or solicitation for the purchase or sale of any security financial instrument. or strategy. Always consult with your independent attorney, tax advisor, investment managers, and insurance agent for final recommendations and before changing or implementing any financial, tax, or estate planning strategy. Bank of America Linkedin Community Guidelines: http://about.bankofamerica.com/en-us/social-media/linkedin-communityguidelines.html
Merrill Lynch A.I CyberSecurity Scoring
Merrill Lynch Risk Score (AI oriented)Between 800 and 849
Merrill Lynch
Updated:
- Powered by our proprietary A.I cyber incident model
- Insurance preferes TPRM score to calculate premium
Merrill Lynch Global Score (TPRM)XXXX
Merrill Lynch
- Instant access to detailed risk factors
- Benchmark vs. industry & size peers
- Vulnerabilities
- Findings
Merrill Lynch Company CyberSecurity News & History
Past Incidents
5
Attack Types
3
Major U.S. Bank: New Malware Targets 200,000+ U.S. Bank Employees to Steal Login Credentials
Cyber Attack
Rankiteo Explanation
Attack with significant impact with internal employee data leaks
Description: Sophisticated Keylogger Attack Targets Major U.S. Bank’s Employee Store, Exposing 200,000 to Credential Theft Cybersecurity researchers have identified a highly targeted keylogger attack on the employee store of one of America’s largest banks, compromising sensitive data for over 200,000 employees. The malware intercepted all form inputs including login credentials, payment card details, and personal information raising concerns about potential lateral movement into the bank’s internal systems. The attack exploited a critical gap in enterprise security: employee-facing ecommerce platforms, which often fall outside standard security audits despite handling corporate credentials. Since bank employees frequently have elevated access to financial systems, such platforms become prime targets for threat actors seeking initial footholds in banking infrastructure. The malware used a two-stage loader to evade detection. The first stage employed character code obfuscation to verify users had reached checkout pages before fetching a secondary harvesting script from *js-csp.com/getInjector/*. The second stage systematically extracted form data including input fields, dropdown menus, and text areas before exfiltrating stolen credentials via image beacon requests to bypass security controls. At the time of discovery, only 1 of 97 security vendors on VirusTotal flagged the malicious infrastructure, highlighting a significant detection gap for ecommerce-specific threats. The attack pattern mirrors previous campaigns, including one targeting the Green Bay Packers, and marks the fifth *getInjector* campaign detected in the past year. The *js-csp.com* domain was registered in late December 2025, with the compromise identified within weeks of deployment. The bank’s response was delayed due to the absence of a *security.txt* file, a standard channel for responsible disclosure. Despite researchers’ attempts to notify the bank via email and LinkedIn, the lack of formal security contacts hindered remediation efforts. The incident underscores the need for organizations to monitor client-side scripts, include internal ecommerce platforms in security audits, and deploy specialized threat detection for this emerging attack surface.
Bank of America
Breach
Rankiteo Explanation
Attack limited on finance or reputation
Description: The Maine Office of the Attorney General reported a data breach related to Bank of America on March 3, 2025, involving an inadvertent disclosure that occurred on February 18, 2025. One individual was affected, and the compromised information included personal details such as names and Social Security numbers. Bank of America offered a complimentary two-year identity theft protection service by Experian.
Bank of America
Breach
Rankiteo Explanation
Attack with significant impact with customers data leaks
Description: The Maine Office of the Attorney General disclosed a data breach affecting Bank of America, detected on October 1, 2024, and reported on January 3, 2025. The incident involved unauthorized access to sensitive personal information, compromising 414 individuals, including at least one Maine resident. While the exact nature of the exposed data was not fully detailed, the breach was severe enough to warrant 24 months of free identity theft protection services via Experian, suggesting the exposure of personally identifiable information (PII) that could facilitate fraud or identity theft. The breach highlights vulnerabilities in Bank of America’s data security measures, raising concerns over potential financial fraud, reputational damage, and regulatory scrutiny. Although the scale (414 individuals) is relatively contained compared to mass breaches, the provision of long-term identity protection indicates a high-risk exposure likely involving financial or identity-related data (e.g., Social Security numbers, account details, or addresses). The incident underscores the persistent threat of cyber intrusions targeting financial institutions, where even limited breaches can have cascading consequences for affected individuals, including phishing attacks, unauthorized transactions, or credit fraud.
Merrill, A Bank of America Company
Breach
Rankiteo Explanation
Attack with significant impact with internal employee data leaks
Description: On April 16, 2024, the Maine Office of the Attorney General disclosed that Bank of America suffered an inadvertent data breach caused by a Merrill employee’s email error, leading to the unauthorized exposure of customer information. The incident impacted 2,676 individuals, including 18 Maine residents, though the exact nature of the exposed data (e.g., financial details, personal identifiers) was not fully specified. In response, Bank of America offered affected individuals two years of complimentary identity theft protection via Experian IdentityWorks™ to mitigate potential risks such as fraud or identity misuse. The breach did not involve malicious cyber activity like hacking or ransomware but stemmed from human error, highlighting vulnerabilities in internal data-handling protocols. While no evidence suggested exploitation of the exposed data, the incident underscored the reputational and operational risks associated with employee-driven data leaks, particularly for a major financial institution. The breach’s scope though limited in scale raised concerns about compliance with data protection regulations and the bank’s ability to safeguard sensitive customer information.
Bank of America
Data Leak
Rankiteo Explanation
Attack with significant impact with internal employee data leaks
Description: Business clients applying for Paycheck Protection Program (PPP) loans with Bank of America have had their personal and business information exposed in a data breach. The data breach occurred on April 22 as Bank of America uploaded customers’ PPP loan applications to the Small Business Administration’s (SBA) online testing system, which allowed lenders to test application submissions. During the testing process, Application information was potentially visible to other lenders and their third-party vendors. The exposed data included both business and clients’ personal information. The affected business data may include business names, addresses, and tax identification numbers. Affected personal data may include names, addresses, Social Security numbers, phone numbers, email addresses, and citizenship information.
Merrill Lynch Company Scoring based on AI Models
Cyber Incidents Likelihood 3 - 6 - 9 months
A.I Risk Score Likelihood 3 - 6 - 9 months
Underwriter Stats for Merrill Lynch
Incidents vs Financial Services Industry Average (This Year)
No incidents recorded for Merrill Lynch in 2026.
Incidents vs All-Companies Average (This Year)
No incidents recorded for Merrill Lynch in 2026.
Incident Types Merrill Lynch vs Financial Services Industry Avg (This Year)
No incidents recorded for Merrill Lynch in 2026.
Incident History — Merrill Lynch (X = Date, Y = Severity)
Merrill Lynch cyber incidents detection timeline including parent company and subsidiaries
Merrill Lynch Company Subsidiaries
Founded in 1914, Merrill is one of the largest wealth management businesses in the world. Merrill financial advisors combine financial knowledge and experience with a deep understanding of their clients’ needs to help their clients pursue the lives they want. With a deep commitment to placing their clients' interests first, Merrill financial advisors draw upon the investment insights of Merrill and the banking insights of Bank of America to unlock opportunities tailored to their clients’ needs in many areas of their financial lives. The strategies our financial advisors offer go beyond investment management to include college savings strategies, retirement planning, eldercare, philanthropy, estate planning services, small business services, and access to cash management & banking strategies. Any opinions, views, statements, estimates or projections ("posts") posted on this web page are solely those of the author(s). Merrill Lynch Global Wealth Management is part of Bank of America Corporation's Global Wealth & Investment Management business. Additional Terms, Conditions & Disclaimers found here: https://www.ml.com/social-media/merrill-lynch-on-twitter.html Disclaimer The site is maintained by a third party that has no affiliation with Merrill Lynch, Pierce, Fenner & Smith Incorporated ("MLPF&S" or "Merrill"). The recommendations posted to this page by or about Merrill employees, are not endorsed by, and may not represent the views. This material is not intended to constitute a recommendation, offer or solicitation for the purchase or sale of any security financial instrument. or strategy. Always consult with your independent attorney, tax advisor, investment managers, and insurance agent for final recommendations and before changing or implementing any financial, tax, or estate planning strategy. Bank of America Linkedin Community Guidelines: http://about.bankofamerica.com/en-us/social-media/linkedin-communityguidelines.html
Loading...
Merrill Lynch Similar Companies
Dubai Holding
Dubai Holding is a diversified global investment company that continues to power Dubai’s growth across 10 key sectors, including real estate, hospitality, leisure & entertainment, media, ICT, design, education, retail, manufacturing & logistics and science. Since 2004, we have made strides with an
Old Mutual South Africa
Old Mutual Limited is a premium pan-African financial services group that offers a broad spectrum of financial solutions to retail and corporate customers across key markets in 14 countries. We have been helping our customers achieve their lifetime financial goals for over 170 years by investing the
Sun Life is a leading financial services organization dedicated to helping people achieve lifetime financial security and live healthier lives. We provide a wide range of insurance and investment products and services in key markets around the world including Canada, the United States, the United K
KPMG US
KPMG is one of the world’s leading professional services firms and the fastest growing Big Four accounting firm in the United States. With 90+ offices and more than 36,000 employees and partners throughout the US, we’re leading the industry in new and exciting ways. Our size and strength make us muc
Shriram Finance Limited
Shriram Finance is the country’s biggest retail NBFC offering credit solutions for commercial vehicles, two-wheeler loans, car loans, home loans, gold loans, personal and small business loans. We are part of the 50-year-old Shriram Group, a financial conglomerate that has emerged as a trusted partne
Mahindra Finance
Mahindra & Mahindra Financial Services Limited (Mahindra Finance), part of the Mahindra Group, is one of India's leading non-banking finance companies. Focused on the rural and semi-urban sector, the Company has over 10 million customers and has an AUM of over USD 11 Billion. The company is a lead
RHB Banking Group
We are a multinational regional financial services provider that is committed to deliver complete solutions to our clients through differentiated segment offerings and an ecosystem that supports simple, fast and seamless customer experience, underpinned by cohesive and inspired workforce and relatio
OTP Group
OTP Group is one of the fastest growing, leading independent banking groups in Central and Eastern Europe with a bridgehead in Central Asia. It operates in 11 countries - 10 in CEE region and 1 in Uzbekistan, employing nearly 40,000 people and providing universal financial services to 17 million cu
Nationale-Nederlanden
NN Group is an international financial services company, active in 10 countries, with a strong presence in a number of European countries and Japan. Our roots lie in the Netherlands, with a rich history of more than 175 years. With our 15,000 employees, NN Group provides retirement services, pensio
.png)
Merrill Lynch CyberSecurity News
March 26, 2026 04:14 PM
AI Is Redrawing the Cybersecurity Vendor Landscape
AI adoption in cybersecurity is still largely consumer-driven, but real growth depends on enterprise deployment.
January 28, 2026 08:00 AM
SPA Names Raj Badhwar as CIO
Systems Planning & Analysis has appointed Raj Badhwar as its chief information officer, placing a longtime cybersecurity and technology...
January 08, 2026 08:00 AM
Using AI carries specific risks for financial advice firms, warns Merrill.
AI tools are highly complex and may be flawed, hallucinate and reflect biases, according to Merrill.
December 02, 2025 08:00 AM
Future in Tech Appoints Ed Moyle as Chief Information Security Officer
FiT appoints cybersecurity leader Ed Moyle as CISO to advance enterprise security, strengthen product protection, and elevate industry...
November 20, 2025 08:00 AM
Key facts: Vodafone aims for 50% revenue growth; share buyback done; ex-dividend on Nov 20
Vodafone Group plans to boost business customer revenue from 25-30% to around 50% by offering AI and cybersecurity services,...
October 20, 2025 07:00 AM
In the Spotlight: Gary Peters
Michigan Sen. Gary Peters, the ranking Democrat on the Homeland Security and Governmental Affairs Committee, recently unveiled legislation...
October 15, 2025 07:00 AM
Cyber Awareness Day
October is National Cybersecurity Awareness Month, and a great reminder for everyone to participate in growing security awareness!
July 30, 2025 07:00 AM
Why Booz Allen’s CTO used generative AI to make a deepfake video of himself
Booz Allen Hamilton's CTO, Bill Vass, made a deepfake video of himself to promote greater worker skepticism of video and audio content and...
April 10, 2025 07:00 AM
Marquis Who's Who Honors Parthasarathi Chakraborty for Excellence in Technology
Parthasarathi Chakraborty is a renowned leader with nearly 30 years of experience in cybersecurity defense and engineering.
Frequently Asked Questions
Explore insights on cybersecurity incidents, risk posture, and Rankiteo's assessments.
Merrill Lynch CyberSecurity History Information
Official Website of Merrill Lynch
The official website of Merrill Lynch is http://www.ml.com.
Merrill Lynch’s AI-Generated Cybersecurity Score
According to Rankiteo, Merrill Lynch’s AI-generated cybersecurity score is 800, reflecting their Good security posture.
How many security badges does Merrill Lynch’ have ?
According to Rankiteo, Merrill Lynch currently holds 0 security badges, indicating that no recognized compliance certifications are currently verified for the organization.
Has Merrill Lynch been affected by any supply chain cyber incidents ?
According to Rankiteo, Merrill Lynch has not been affected by any supply chain cyber incidents, and no incident IDs are currently listed for the organization.
Does Merrill Lynch have SOC 2 Type 1 certification ?
According to Rankiteo, Merrill Lynch is not certified under SOC 2 Type 1.
Does Merrill Lynch have SOC 2 Type 2 certification ?
According to Rankiteo, Merrill Lynch does not hold a SOC 2 Type 2 certification.
Does Merrill Lynch comply with GDPR ?
According to Rankiteo, Merrill Lynch is not listed as GDPR compliant.
Does Merrill Lynch have PCI DSS certification ?
According to Rankiteo, Merrill Lynch does not currently maintain PCI DSS compliance.
Does Merrill Lynch comply with HIPAA ?
According to Rankiteo, Merrill Lynch is not compliant with HIPAA regulations.
Does Merrill Lynch have ISO 27001 certification ?
According to Rankiteo,Merrill Lynch is not certified under ISO 27001, indicating the absence of a formally recognized information security management framework.
Industry Classification of Merrill Lynch
Merrill Lynch operates primarily in the Financial Services industry.
Number of Employees at Merrill Lynch
Merrill Lynch employs approximately 34,603 people worldwide.
Subsidiaries Owned by Merrill Lynch
Merrill Lynch presently has no subsidiaries across any sectors.
Merrill Lynch’s LinkedIn Followers
Merrill Lynch’s official LinkedIn profile has approximately 748,637 followers.
NAICS Classification of Merrill Lynch
Merrill Lynch is classified under the NAICS code 52, which corresponds to Finance and Insurance.
Merrill Lynch’s Presence on Crunchbase
No, Merrill Lynch does not have a profile on Crunchbase.
Merrill Lynch’s Presence on LinkedIn
Yes, Merrill Lynch maintains an official LinkedIn profile, which is actively utilized for branding and talent engagement, which can be accessed here: https://www.linkedin.com/company/merrilllynch.
Cybersecurity Incidents Involving Merrill Lynch
As of April 04, 2026, Rankiteo reports that Merrill Lynch has experienced 5 cybersecurity incidents.
Number of Peer and Competitor Companies
Merrill Lynch has an estimated 31,558 peer or competitor companies worldwide.
What types of cybersecurity incidents have occurred at Merrill Lynch ?
Incident Types: The types of cybersecurity incidents that have occurred include Data Leak, Breach and Cyber Attack.
How does Merrill Lynch detect and respond to cybersecurity incidents ?
Detection and Response: The company detects and responds to cybersecurity incidents through an third party assistance with experian, and remediation measures with complimentary two-year identity theft protection service, and incident response plan activated with likely (standard protocol for data breaches), and third party assistance with experian (identityworks™ services), and remediation measures with offering 2-year complimentary identity theft protection (experian identityworks™), and communication strategy with notification to affected individuals via maine ag report, and third party assistance with experian (identity theft protection), and communication strategy with delayed due to absence of security.txt file..
Incident Details
Can you provide details on each incident ?
Title: Bank of America PPP Loan Data Breach
Description: Business clients applying for Paycheck Protection Program (PPP) loans with Bank of America have had their personal and business information exposed in a data breach.
Date Detected: April 22, 2020
Type: Data Breach
Attack Vector: Improper Data Handling
Vulnerability Exploited: Improper Data Handling
Title: Bank of America Data Breach
Description: The Maine Office of the Attorney General reported a data breach related to Bank of America on March 3, 2025, involving an inadvertent disclosure that occurred on February 18, 2025. One individual was affected, and the compromised information included personal details such as names and Social Security numbers. Bank of America offered a complimentary two-year identity theft protection service by Experian.
Date Detected: 2025-02-18
Date Publicly Disclosed: 2025-03-03
Type: Data Breach
Attack Vector: Inadvertent Disclosure
Title: Bank of America Inadvertent Disclosure of Customer Information via Merrill Employee Email Error
Description: The Maine Office of the Attorney General reported that Bank of America experienced an inadvertent disclosure of customer information on April 16, 2024, due to a Merrill employee email error, affecting a total of 2,676 individuals, including 18 Maine residents. Bank of America is offering a complimentary two-year membership in identity theft protection services through Experian IdentityWorks™.
Date Detected: 2024-04-16
Date Publicly Disclosed: 2024-04-16
Type: Data Breach (Inadvertent Disclosure)
Attack Vector: Human Error (Email Misconfiguration)
Title: Bank of America Data Breach (2024)
Description: The Maine Office of the Attorney General reported a data breach involving Bank of America. The breach occurred on October 1, 2024, affecting 414 individuals, including 1 resident of Maine. Unauthorized access was detected, and identity theft protection services (24 months via Experian) were offered to affected individuals.
Date Detected: 2024-10-01
Date Publicly Disclosed: 2025-01-03
Type: Data Breach
Title: Sophisticated Keylogger Attack Targets Major U.S. Bank’s Employee Store, Exposing 200,000 to Credential Theft
Description: Cybersecurity researchers have identified a highly targeted keylogger attack on the employee store of one of America’s largest banks, compromising sensitive data for over 200,000 employees. The malware intercepted all form inputs including login credentials, payment card details, and personal information, raising concerns about potential lateral movement into the bank’s internal systems. The attack exploited a critical gap in enterprise security: employee-facing ecommerce platforms, which often fall outside standard security audits despite handling corporate credentials. The malware used a two-stage loader to evade detection, systematically extracting form data before exfiltrating stolen credentials via image beacon requests to bypass security controls.
Type: Keylogger Attack
Attack Vector: Malicious script injection (client-side)
Vulnerability Exploited: Lack of security audits for employee-facing ecommerce platforms
Motivation: Credential theft for potential lateral movement into banking infrastructure
What are the most common types of attacks the company has faced ?
Common Attack Types: The most common types of attacks the company has faced is Breach.
How does the company identify the attack vectors used in incidents ?
Identification of Attack Vectors: The company identifies the attack vectors used in incidents through Employee-facing ecommerce platform.
Impact of the Incidents
What was the impact of each incident ?
Incident : Data Breach BAN2212291222
Data Compromised: Business names, Addresses, Tax identification numbers, Names, Social security numbers, Phone numbers, Email addresses, Citizenship information
Incident : Data Breach BAN832072725
Data Compromised: Names, Social security numbers
Identity Theft Risk: High
Incident : Data Breach (Inadvertent Disclosure) BAN721082025
Data Compromised: Customer information
Brand Reputation Impact: Potential (Mitigated by Identity Theft Protection Offer)
Identity Theft Risk: High (Mitigated by Experian IdentityWorks™ Offer)
Incident : Data Breach BAN030091825
Identity Theft Risk: True
Incident : Keylogger Attack BAN1769475353
Data Compromised: Login credentials, payment card details, personal information
Systems Affected: Employee-facing ecommerce platform
Operational Impact: Potential lateral movement into internal banking systems
Identity Theft Risk: High
Payment Information Risk: High
What types of data are most commonly compromised in incidents ?
Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Business Names, Addresses, Tax Identification Numbers, Names, Social Security Numbers, Phone Numbers, Email Addresses, Citizenship Information, , Personal Information, , Customer Information (Details Unspecified), Login Credentials, Payment Card Details, Personal Information and .
Which entities were affected by each incident ?
Incident : Data Breach BAN2212291222
Entity Name: Bank of America
Entity Type: Financial Institution
Industry: Banking
Incident : Data Breach BAN832072725
Entity Name: Bank of America
Entity Type: Financial Institution
Industry: Banking
Customers Affected: 1
Incident : Data Breach (Inadvertent Disclosure) BAN721082025
Entity Name: Bank of America (via Merrill)
Entity Type: Financial Institution
Industry: Banking/Financial Services
Location: United States (Maine residents among affected)
Size: Large (Multinational)
Customers Affected: 2,676 (including 18 Maine residents)
Incident : Data Breach BAN030091825
Entity Name: Bank of America
Entity Type: Financial Institution
Industry: Banking/Financial Services
Location: United States
Customers Affected: 414
Incident : Keylogger Attack BAN1769475353
Entity Name: Major U.S. Bank (unnamed)
Entity Type: Bank
Industry: Financial Services
Location: United States
Customers Affected: 200,000 employees
Response to the Incidents
What measures were taken in response to each incident ?
Incident : Data Breach BAN832072725
Third Party Assistance: Experian.
Remediation Measures: Complimentary two-year identity theft protection service
Incident : Data Breach (Inadvertent Disclosure) BAN721082025
Incident Response Plan Activated: Likely (Standard Protocol for Data Breaches)
Third Party Assistance: Experian (Identityworks™ Services).
Remediation Measures: Offering 2-year complimentary identity theft protection (Experian IdentityWorks™)
Communication Strategy: Notification to affected individuals via Maine AG report
Incident : Data Breach BAN030091825
Third Party Assistance: Experian (Identity Theft Protection).
Incident : Keylogger Attack BAN1769475353
Communication Strategy: Delayed due to absence of security.txt file
What is the company's incident response plan?
Incident Response Plan: The company's incident response plan is described as Likely (Standard Protocol for Data Breaches).
How does the company involve third-party assistance in incident response ?
Third-Party Assistance: The company involves third-party assistance in incident response through Experian, , Experian (IdentityWorks™ Services), , Experian (Identity Theft Protection), .
Data Breach Information
What type of data was compromised in each breach ?
Incident : Data Breach BAN2212291222
Type of Data Compromised: Business names, Addresses, Tax identification numbers, Names, Social security numbers, Phone numbers, Email addresses, Citizenship information
Sensitivity of Data: High
Incident : Data Breach BAN832072725
Type of Data Compromised: Personal information
Number of Records Exposed: 1
Sensitivity of Data: High
Personally Identifiable Information: NamesSocial Security numbers
Incident : Data Breach (Inadvertent Disclosure) BAN721082025
Type of Data Compromised: Customer Information (Details Unspecified)
Number of Records Exposed: 2,676
Sensitivity of Data: Moderate to High (PII likely included)
Personally Identifiable Information: Likely (Given Identity Theft Protection Offer)
Incident : Data Breach BAN030091825
Number of Records Exposed: 414
Incident : Keylogger Attack BAN1769475353
Type of Data Compromised: Login credentials, Payment card details, Personal information
Number of Records Exposed: 200,000
Sensitivity of Data: High
Data Exfiltration: Yes (via image beacon requests)
Personally Identifiable Information: Yes
What measures does the company take to prevent data exfiltration ?
Prevention of Data Exfiltration: The company takes the following measures to prevent data exfiltration: Complimentary two-year identity theft protection service, , Offering 2-year complimentary identity theft protection (Experian IdentityWorks™), .
Regulatory Compliance
Were there any regulatory violations and fines imposed for each incident ?
Incident : Data Breach (Inadvertent Disclosure) BAN721082025
Regulatory Notifications: Maine Office of the Attorney General
Incident : Data Breach BAN030091825
Regulatory Notifications: Maine Office of the Attorney General
Lessons Learned and Recommendations
What lessons were learned from each incident ?
Incident : Keylogger Attack BAN1769475353
Lessons Learned: Organizations need to monitor client-side scripts, include internal ecommerce platforms in security audits, and deploy specialized threat detection for this emerging attack surface. The absence of a security.txt file hindered responsible disclosure and remediation efforts.
What recommendations were made to prevent future incidents ?
Incident : Keylogger Attack BAN1769475353
Recommendations: Monitor client-side scripts for malicious activity, Include employee-facing ecommerce platforms in security audits, Deploy specialized threat detection for ecommerce-specific threats, Implement a security.txt file for responsible disclosureMonitor client-side scripts for malicious activity, Include employee-facing ecommerce platforms in security audits, Deploy specialized threat detection for ecommerce-specific threats, Implement a security.txt file for responsible disclosureMonitor client-side scripts for malicious activity, Include employee-facing ecommerce platforms in security audits, Deploy specialized threat detection for ecommerce-specific threats, Implement a security.txt file for responsible disclosureMonitor client-side scripts for malicious activity, Include employee-facing ecommerce platforms in security audits, Deploy specialized threat detection for ecommerce-specific threats, Implement a security.txt file for responsible disclosure
What are the key lessons learned from past incidents ?
Key Lessons Learned: The key lessons learned from past incidents are Organizations need to monitor client-side scripts, include internal ecommerce platforms in security audits, and deploy specialized threat detection for this emerging attack surface. The absence of a security.txt file hindered responsible disclosure and remediation efforts.
References
Where can I find more information about each incident ?
Incident : Data Breach BAN832072725
Source: Maine Office of the Attorney General
Date Accessed: 2025-03-03
Incident : Data Breach (Inadvertent Disclosure) BAN721082025
Source: Maine Office of the Attorney General
Date Accessed: 2024-04-16
Incident : Data Breach BAN030091825
Source: Maine Office of the Attorney General
Date Accessed: 2025-01-03
Incident : Keylogger Attack BAN1769475353
Source: Cybersecurity researchers
Where can stakeholders find additional resources on cybersecurity best practices ?
Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: Maine Office of the Attorney GeneralDate Accessed: 2025-03-03, and Source: Maine Office of the Attorney GeneralDate Accessed: 2024-04-16, and Source: Maine Office of the Attorney GeneralDate Accessed: 2025-01-03, and Source: Cybersecurity researchers.
Investigation Status
What is the current status of the investigation for each incident ?
Incident : Data Breach (Inadvertent Disclosure) BAN721082025
Investigation Status: Disclosed (No Further Details)
How does the company communicate the status of incident investigations to stakeholders ?
Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through Notification To Affected Individuals Via Maine Ag Report and Delayed due to absence of security.txt file.
Stakeholder and Customer Advisories
Were there any advisories issued to stakeholders or customers for each incident ?
Incident : Data Breach (Inadvertent Disclosure) BAN721082025
Customer Advisories: Offer of 2-year Experian IdentityWorks™ membership
Incident : Data Breach BAN030091825
Customer Advisories: Identity theft protection services (24 months via Experian) offered to affected individuals
What advisories does the company provide to stakeholders and customers following an incident ?
Advisories Provided: The company provides the following advisories to stakeholders and customers following an incident: were Offer Of 2-Year Experian Identityworks™ Membership, , Identity Theft Protection Services (24 Months Via Experian) Offered To Affected Individuals and .
Initial Access Broker
How did the initial access broker gain entry for each incident ?
Incident : Keylogger Attack BAN1769475353
Entry Point: Employee-facing ecommerce platform
High Value Targets: Bank employees with elevated access to financial systems
Data Sold on Dark Web: Bank employees with elevated access to financial systems
Post-Incident Analysis
What were the root causes and corrective actions taken for each incident ?
Incident : Data Breach (Inadvertent Disclosure) BAN721082025
Root Causes: Human Error (Merrill Employee Email Misconfiguration),
Incident : Keylogger Attack BAN1769475353
Root Causes: Lack Of Security Audits For Employee-Facing Ecommerce Platforms, Absence Of Security.Txt File For Responsible Disclosure, Detection Gap For Ecommerce-Specific Threats,
What is the company's process for conducting post-incident analysis ?
Post-Incident Analysis Process: The company's process for conducting post-incident analysis is described as Experian, , Experian (Identityworks™ Services), , Experian (Identity Theft Protection), .
Additional Questions
Incident Details
What was the most recent incident detected ?
Most Recent Incident Detected: The most recent incident detected was on April 22, 2020.
What was the most recent incident publicly disclosed ?
Most Recent Incident Publicly Disclosed: The most recent incident publicly disclosed was on 2025-01-03.
Impact of the Incidents
What was the most significant data compromised in an incident ?
Most Significant Data Compromised: The most significant data compromised in an incident were Business names, Addresses, Tax identification numbers, Names, Social Security numbers, Phone numbers, Email addresses, Citizenship information, , Names, Social Security numbers, , Customer Information, , , Login credentials, payment card details and personal information.
Response to the Incidents
What third-party assistance was involved in the most recent incident ?
Third-Party Assistance in Most Recent Incident: The third-party assistance involved in the most recent incident was experian, , experian (identityworks™ services), , experian (identity theft protection), .
Data Breach Information
What was the most sensitive data compromised in a breach ?
Most Sensitive Data Compromised: The most sensitive data compromised in a breach were Social Security numbers, Citizenship information, Tax identification numbers, Business names, Addresses, Phone numbers, Email addresses, Customer Information, Login credentials, payment card details, personal information and Names.
What was the number of records exposed in the most significant breach ?
Number of Records Exposed in Most Significant Breach: The number of records exposed in the most significant breach was 203.1K.
Lessons Learned and Recommendations
What was the most significant lesson learned from past incidents ?
Most Significant Lesson Learned: The most significant lesson learned from past incidents was Organizations need to monitor client-side scripts, include internal ecommerce platforms in security audits, and deploy specialized threat detection for this emerging attack surface. The absence of a security.txt file hindered responsible disclosure and remediation efforts.
What was the most significant recommendation implemented to improve cybersecurity ?
Most Significant Recommendation Implemented: The most significant recommendation implemented to improve cybersecurity was Deploy specialized threat detection for ecommerce-specific threats, Implement a security.txt file for responsible disclosure, Monitor client-side scripts for malicious activity and Include employee-facing ecommerce platforms in security audits.
References
What is the most recent source of information about an incident ?
Most Recent Source: The most recent source of information about an incident are Cybersecurity researchers and Maine Office of the Attorney General.
Investigation Status
What is the current status of the most recent investigation ?
Current Status of Most Recent Investigation: The current status of the most recent investigation is Disclosed (No Further Details).
Stakeholder and Customer Advisories
What was the most recent customer advisory issued ?
Most Recent Customer Advisory: The most recent customer advisory issued were an Offer of 2-year Experian IdentityWorks™ membership and Identity theft protection services (24 months via Experian) offered to affected individuals.
Initial Access Broker
What was the most recent entry point used by an initial access broker ?
Most Recent Entry Point: The most recent entry point used by an initial access broker was an Employee-facing ecommerce platform.
Post-Incident Analysis
What was the most significant root cause identified in post-incident analysis ?
Most Significant Root Cause: The most significant root cause identified in post-incident analysis was Human Error (Merrill Employee Email Misconfiguration), Lack of security audits for employee-facing ecommerce platformsAbsence of security.txt file for responsible disclosureDetection gap for ecommerce-specific threats.
.png)
Latest Global CVEs (Not Company-Specific)
Description
nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.3.0, two peer-facing consensus request handlers assume that the history index is always available and call blockchain.history_store.history_index().unwrap() directly. That assumption is false by construction. HistoryStoreProxy::history_index() explicitly returns None for the valid HistoryStoreProxy::WithoutIndex state. when a full node is syncing or otherwise running without the history index, a remote peer can send RequestTransactionsProof or RequestTransactionReceiptsByAddress and trigger an Option::unwrap() panic on the request path. This issue has been patched in version 1.3.0.
Risk Information
cvss3
Base: 5.3
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Description
PraisonAI is a multi-agent teams system. Prior to version 1.5.95, FileTools.download_file() in praisonaiagents validates the destination path but performs no validation on the url parameter, passing it directly to httpx.stream() with follow_redirects=True. An attacker who controls the URL can reach any host accessible from the server including cloud metadata services and internal network services. This issue has been patched in version 1.5.95.
Risk Information
cvss3
Base: 8.6
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Description
PraisonAI is a multi-agent teams system. Prior to version 4.5.97, OAuthManager.validate_token() returns True for any token not found in its internal store, which is empty by default. Any HTTP request to the MCP server with an arbitrary Bearer token is treated as authenticated, granting full access to all registered tools and agent capabilities. This issue has been patched in version 4.5.97.
Risk Information
cvss3
Base: 9.1
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Description
PraisonAI is a multi-agent teams system. Prior to version 4.5.97, the PraisonAI Gateway server accepts WebSocket connections at /ws and serves agent topology at /info with no authentication. Any network client can connect, enumerate registered agents, and send arbitrary messages to agents and their tool sets. This issue has been patched in version 4.5.97.
Risk Information
cvss3
Base: 9.1
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Description
PraisonAI is a multi-agent teams system. Prior to version 4.5.90, MCPToolIndex.search_tools() compiles a caller-supplied string directly as a Python regular expression with no validation, sanitization, or timeout. A crafted regex causes catastrophic backtracking in the re engine, blocking the Python thread for hundreds of seconds and causing a complete service outage. This issue has been patched in version 4.5.90.
Risk Information
cvss3
Base: 6.5
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Access Data Using Our API
Get company history
curl -i -X GET 'https://api.rankiteo.com/underwriter-getcompany-history?linkedin_id=merrilllynch' -H 'apikey: YOUR_API_KEY_HERE'
RapidWhat Do We Measure ?
Incident
Finding
Grade
Digital Assets
Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.
These are some of the factors we use to calculate the overall score:
Network Security
Identify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.
SBOM (Software Bill of Materials)
Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.
CMDB (Configuration Management Database)
Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.
Threat Intelligence
Leverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.
Rankiteo is a unified scoring and risk platform that analyzes billions of signals weekly to help organizations gain faster, more actionable insights into emerging threats. Empowering teams to outpace adversaries and reduce exposure.
