Ex-Employee Sparks Major Data Breach at FinWise Bank

Utah-based FinWise Bank disclosed a significant data security incident in which sensitive personal data of its corporate customers was compromised after a former employee accessed confidential files following the end of their employment.

 

In a data security incident notice filed with the Office of Maine Attorney General, FinWise, on behalf of  American First Finance said that on  May 31, 2024, it identified that a former employee gained access to FinWise data after the end of their employment. The financial institution immediately launched an investigation, with assistance from external cyber security experts, to determine the scope of the incident.

 

FinWise partners with American First Finance to offer instalment loans, with FinWise as the lender and AFF providing the technology platform, loan facilitation, and servicing.

 

“Our extensive forensic investigation and manual document review discovered that certain files containing your personal information may have been accessed or acquired as a result of this incident,” FinWise said.

 

The compromised data included names and other personal information including Social Security Numbers.  The filing with the Maine state regulator’s office also states that FinWise has identified 689,000 American First Finance affected by the incident.

 

FinWise has advised all affected individuals to regularly monitor their credit reports, account and benefit statements and report any suspicious activity to law enforcement authorities, including the police and state attorney general. 

 

It has also offered two years of complimentary identity protection and credit monitoring services through IDX to all affected individuals.

 

The company did not disclose how the former employee accessed the data after their employment ended or the total number of individuals impacted by the FinWise breach. The company is currently confronting several class-action lawsuits stemming from the incident.