Evolve Bank confirms LockBit ransomware attack led to a major customer data breach

Arkansas-based Evolve Bank & Trust recently disclosed a data security incident that compromised the sensitive personal information of its customers and also customers of its financial technology partners.

 

In a data security incident notice posted on its website, the bank said it is “investigating a cybersecurity incident involving a known cybercriminal organization that appears to have illegally obtained and released on the dark web the data and personal information of some Evolve retail bank customers and financial technology partners’ customers.”

 

Evolve has notified relevant law enforcement authorities about the incident and is working with them to resolve the issue at the earliest.

 

“Based on what our investigation has found and what we know at this time, we are confident this incident has been contained and there is no ongoing threat,” the bank said.

 

In an update, Evolve said that the sensitive personal information of its customers including their names, Social Security Numbers, dates of birth, account information and other personal information were compromised during the incident.

 

The bank, however, confirmed that retail banking customers’ debit cards, online, and digital banking credentials were not accessed.

 

“Evolve will communicate directly to all customers and financial technology partners in the impacted areas of our business. We expect those communications to last for some time. We ask that you check your email for updates. All customers and financial technology partner’s end users should remain vigilant and report any suspicious account activity immediately,” the bank added.

 

On June 23, the LockBit ransomware group claimed to have stolen 33 terabytes of data from the US Federal Reserve and three days later, the group published the stolen data on the dark web. An analysis of the data showed that the stolen information belongs to Evolve Bank & Trust and not from the United States’ central bank.