Evolve Bank & Trust Data Breach

In late May 2024, the LockBit ransomware group gained unauthorized access to Evolve Bank & Trust's systems. LockBit exfiltrated over 7.6 million customer records before deploying ransomware. The breach was particularly significant because Evolve Bank provides back-end banking services to dozens of fintech companies, meaning the breach cascaded across the fintech ecosystem. Affected companies included Affirm, Mercury, Wise, Stripe, and many others. The stolen data included customer names, Social Security Numbers, bank account numbers, and loan information. The incident highlighted the systemic risk of centralized banking-as-a-service (BaaS) infrastructure.

Evolve Bank & Trust is a traditional bank that provides Banking-as-a-Service (BaaS) infrastructure to numerous fintech companies. Its platform handles everything from payment processing to loan origination for partners across the financial technology sector.

LockBit gained initial access through compromised credentials, likely obtained via phishing or purchased from initial access brokers. They then moved laterally through Evolve's network to access customer databases containing records from multiple fintech partners.

LockBit is one of the most prolific ransomware operations, operating a Ransomware-as-a-Service (RaaS) model. Despite law enforcement takedown attempts in 2024, LockBit has continued operations.

Aliases

• LockBit 3.0

Attribution sources

• LockBit leak site
• Evolve Bank statements
• FBI
• Fintech partners

Additional victims

• Affirm
• Mercury
• Wise
• Stripe
• Multiple fintech companies

Countries affected

• United States
• Global

Data types

• PII
• SSNs
• Bank account numbers
• Loan data
• Names
• Addresses
• Dates of birth

Massive cascading impact across fintech ecosystem; regulatory fines from multiple agencies.

Public reaction

Significant concern among fintech users about banking-as-a-service security and data aggregation risks.

Political impact

Increased regulatory scrutiny of Banking-as-a-Service (BaaS) partnerships and third-party risk management in financial services.

Multiple regulatory investigations; potential class-action lawsuits from affected customers.

Civil lawsuits

• Anticipated class-action lawsuits

Policy changes

• Calls for stronger oversight of fintech-banking partnerships.

Security improvements

• Enhanced third-party risk assessments for BaaS providers.

Significance

One of the most impactful fintech ecosystem breaches, demonstrating systemic risk in centralized banking infrastructure.

Legacy

Led to major reassessment of Banking-as-a-Service risk models and fintech vendor concentration risk.

Publishing organisations

• BleepingComputer
• TechCrunch
• Bloomberg
• KrebsOnSecurity

Evolve Bank contained the breach and notified affected fintech partners and customers.

Official documents

• Evolve Bank SEC filing
• Fintech partner breach notifications

References

1. [1]BleepingComputer: Evolve Bank breach coverage
2. [2]TechCrunch: Fintech ecosystem impact