Evolve Discloses That Hackers Stole Data of 7.6M Individuals – Source: www.databreachtoday.com

Finance & Banking
,
Fraud Management & Cybercrime
,
Incident & Breach Response

Stolen Data Includes Names, Social Security and Bank Account Numbers, Contact Info

David Perera (@daveperera) •
July 9, 2024    

Evolve Bank & Trust disclosed that hackers stole the data of more than 7.6 million individuals in an incident detected in May.

The Arkansas firm has been in incident disclosure mode for weeks now, following Evolve’s listing on the leak site of the Russian-speaking ransomware-as-a-service operation LockBit in late June.

See Also: NHS Ransomware Attack: Healthcare Industry Infrastructures Are Critical

In an official disclosure, Evolve said it detected hackers on May 29 and at first attributed signs of a malicious breach to “a hardware failure.” An investigation showed hackers penetrated the bank’s systems as early as February.

“No new unauthorized activity on Evolve’s systems has been identified since May 31, 2024,” the company said.

The tally of affected individuals, which include Evolve clients as well as customers of its banking platform, is 7,640,112.

Evolve Bancorp operates both a traditional bank and open banking services, which it provides to a number of fintech companies via what’s often referred to as banking as a service.

In a copy of the data breach notification letter it filed, Evolve didn’t disclose the types of data that hackers stole, but the company has already acknowledged that hackers stole names, Social Security numbers, bank account numbers and contact information.

The incident has had a cascading effect on the financial industry as Evolve customers are notifying their customers that hackers stole their data. Among the affected current and past clients of Evolve are “buy now, pay later” creditor Affirm and money transfer service Wise (see: Evolve Ransomware Hack Affects Affirm and Fintech Companies).

June was a challenging month for the company. Just days before LockBit disclosed the attack, the Federal Reserve Board ordered the bank to improve its anti-money laundering and risk management programs, “including through enhanced procedures related to recordkeeping and consumer compliance programs.”

LockBit initially claimed to have hacked the Federal Reserve rather than Evolve, likely because the hacker spotted a stolen document that said “United States Federal Reserve” and assumed the victim was the central bank (see: Bogus: LockBit’s Claimed Federal Reserve Ransomware Hit).