Evolve Bank confirms data breach after brazen LockBit claims

Arkansas-based Evolve Bank & Trust confirmed on Wednesday that hackers stole customer information and posted it on the dark web. 

The bank said it is investigating the incident — carried out by a “known cybercriminal organization” — and is working with law enforcement. 

“Based on what our investigation has found and what we know at this time, we are confident this incident has been contained and there is no ongoing threat,” they said. 

The bank said the hackers “released illegally obtained data, including Personal Identification Information (PII), on the dark web.”

“The data varies by individual but may include your name, Social Security Number, date of birth, account information and/or other personal information,” the bank explained.

“Evolve Retail Banking customers’ debit cards, online, and digital banking credentials do not appear to be impacted by the cybersecurity incident,” an Evolve spokesperson added. 

Victims will be contacted with more information on free credit monitoring services, and some impacted customers will be given new account numbers.  

The hackers behind the cyberattack appear to be affiliated with Lockbit, the ransomware-as-a-service group that was disrupted in February in a much-celebrated international operation. 

The gang claimed this week to have breached the U.S. Federal Reserve, but an initial batch of leaked documents supposedly linked to the agency reportedly actually belonged to Evolve Bank & Trust. 

The company did not provide any additional information about how the data was accessed or how many people were affected by the breach. 

The financial services institution is known for its partnerships with fintech companies, including Affirm and Stripe. Earlier this month, it was subject to a Federal Reserve enforcement action for alleged deficiencies in anti-money laundering controls and risk management practices. 

The LockBit ransomware gang claimed for days that it hacked the Federal Reserve before unveiling what they stole on Tuesday evening. Its dark web post links to a press release about the Federal Reserve enforcement action against Evolve Bank alongside a trove of information apparently taken from the institution's systems. 

The group’s leader has tried desperately to return the gang to its previous prominence but has been largely unable to conduct new attacks, instead reposting data stolen in previous incidents.

Additional reporting by Jonathan Greig