Breach Report: 1st Franklin Financial breach affects 147,000+, results in multiple lawsuits

(image source: 1st Franklin Financial Corporation, n.d.)

One-sentence summary:

1st Franklin Financial Corp. suffered a breach in Nov. 2022, affecting over 147,000+ and resulting in multiple class action lawsuits.

Who was involved?

1st Franklin Financial Corporation, 147,000+ potential breach victims, and a threat actor.

What was the timeline?

November 17, 2022: Data breach occurs, and 1st Franklin said “we immediately investigated and aggressively responded”

December 15, 2022: Breached data is discovered by 1st Franklin Financial per Maine OAG report (Moody, 2023)

January 10, 2023: 1st Franklin notifies Maine Attorney General’s office of 2 individuals affected, also starts consumer notification

February 22, 2023: 1st Franklin notifies South Carolina Department of Consumer Affairs of 147,000+ affected

March 2, 2023: Laney v. 1st Franklin Financial Corporation is filed in Georgia and other class action lawsuits are reported

What occurred?

1st Franklin Financial Corp. was breached in Nov. 2022, resulting in the potential disclosure of sensitive data for over 147,000+ victims, including: “first and last names, social security number, Plan Group Number, Plan Member Number, claim status, date(s) of service, prescription information, pharmacy provider name, amount billed, and other information submitted to process for claims for benefits under the Plan” (SC DCA, 2023; 1st Franklin Financial Corporation, 2023, p. 1). 1st Franklin Financial is currently facing multiple class-action lawsuits as a result of this data breach (Justia, 2023; Mehorter, 2023).

Estimated costs:

Associated incident response costs, “Outside technical experts,” M-F call center, free 12 months Experian IdentityWorks and $1 million identity insurance, litigation defense costs

Involved laws:

Federal:

Federal Trade Commission Act, 15 U.S.C. § 45 (Moreland v. 1st Franklin Financial Corporation, 2023, p. 34)

State laws:

Maine: 10 M.R.S.A. § 1346

Georgia: Georgia Deceptive Trade Practices Act (“Georgia
DTPA”), Ga. Code Ann. § 10- 1-370(5) (Laney v. 1st Franklin Financial Corporation, 2023, p. 40)

Vermont: 9 V.S.A. § 2435

South Carolina: South Carolina Code 39-1-90

Root cause:

TBA or N/A (see disclaimer)

Lessons learned:

TBA or N/A (see disclaimer)

Sources:

1st Franklin Financial Corporation. (n.d.). First%20Franklin1ffc%20Logo_Black%20%20Gold_200px%20(002)_150517-113443.jpg. Livingston Parish Chamber of Commerce. https://chambermaster.blob.core.windows.net/images/members/789/2517/First%20Franklin1ffc%20Logo_Black%20%20Gold_200px%20(002)_150517-113443.jpg

1st Franklin Financial Corporation. (2023). 1stFranklinFinancialCorporation.pdf. In Security Breach Notices (A10131 v.01). South Carolina Department of Consumer Affairs. Retrieved April 5, 2023, from https://www.consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2023/1stFranklinFinancialCorporation.pdf

Justia. (2023, March 2). Laney v. 1st Franklin Financial Corporation. Justia Dockets & Filings. Retrieved April 6, 2023, from https://dockets.justia.com/docket/georgia/gandce/1:2023cv00916/312763

Laney v. 1st Franklin Financial Corporation, Docket No. 1:23-cv-00916-VMC (N.D. Ga. 2023). https://www.classaction.org/media/laney-v-1st-franklin-financial-corporation.pdf

Mehorter, K. (2023, March 7). 1st Franklin Financial Corporation Hit with Class Actions Over November 2022 Data Breach. ClassAction.org. Retrieved April 6, 2023, from https://www.classaction.org/news/1st-franklin-financial-corporation-hit-with-class-actions-over-november-2022-data-breach

Moody, B. (2023). Data Breach Notifications. In Office of the Maine Attorney General. Retrieved April 5, 2023, from https://apps.web.maine.gov/online/aeviewer/ME/40/67581131-b87e-4c02-859e-5bbfae6d8ba9.shtml

Moreland v. 1st Franklin Financial Corporation, Docket No. 2:23-cv-00038-RWS (N.D. Ga. 2023). https://www.classaction.org/media/moreland-v-1st-franklin-financial-corporation.pdf

SC DCA. (2023). Security Breach Notices. In South Carolina Department of Consumer Affairs. State of South Carolina. Retrieved April 5, 2023, from https://www.consumer.sc.gov/identity-theft-unit/security-breach-notices

About Post Author

Kyler Kent CISSP

Kyler Kent is a Senior Cybersecurity Analyst on CrowdStrike’s Falcon Complete MDR team, where he helps large enterprises detect, investigate, and contain real intrusions across cloud and hybrid environments. His work spans threat hunting, incident response, and security automation—turning noisy telemetry into clear, repeatable actions that reduce risk quickly. Previously, Kyler served as a Threat Hunting and Intelligence Specialist supporting a critical infrastructure provider in Dallas, and led security automation and operational coordination at CyberConvoy. He holds a Master’s in Cybersecurity Risk Management from Georgetown University and maintains certifications including CISSP, AWS Solutions Architect – Professional, AWS Security – Specialty, and multiple CrowdStrike credentials. He writes to close the gap between “what the textbook says” and what analysts actually do on shift with his published book: "SOC Analyst Career Guide" (ISBN-13: 9781835467466). https://linktr.ee/kentprotect.com Corrections: [email protected]

http://kylerkent.com