Fintech
Evolve Ransomware Attack Hits Affirm, Fintech Firms
Finance and Banking
,
Response to incidents and breaches
,
Industry specific
Startups and Evolve Client are monitoring the situation for possible fallout
David Perera (@daveperera) • July 2, 2024
A ransomware attack didn’t stop Affirm customers from buying now and paying later. (Image: Shutterstock)
A ransomware attack on Evolve Bank & Trust has triggered a small cascade of secondary breach notifications from current and former customers of the banking services company.
See also: Securing the Cloud for Financial Services
Russian-language ransomware-as-a-service operation LockBit attacked the Tennessee company in May after “an employee inadvertently clicked on a malicious Internet link,” Evolve disclosed.
Evolve said preliminary investigation results show that hackers stole the names, Social Security numbers, bank account numbers and contact information of most of its personal banking customers, as well as customers of its platform banking business.
Among the customers affected by the data breach is Affirm, the “buy now, pay later” consumer credit provider. In a regulatory filing, Affirm She said “believes that Affirm card users’ personal information was compromised as part of the Evolve cybersecurity incident.” Affirm shares customer information with Evolve as part of the card issuance process.
The complaint states that the ransomware incident did not impact Affirm customers’ ability to continue purchasing products and pay for them later.
Money transfer service Wise was also implicated in the breach, She said worked with Evolve from 2020 to 2023. The data shared with the Tennessee company included name, address, contact information, and date of birth, as well as Social Security numbers or similar identifiers for international customers.
“Evolve has not yet confirmed to us what data was affected,” Wise said.
The high-interest, low-credit-score non-bank credit card company Mercury Financial, which uses Evolve to issue the cards, is tell customers that hackers may have stolen their data. The information at risk includes “certain account numbers, deposit balances, business owner names, and emails associated with Mercury and other fintech accounts.”
Fintech startups and clients of Evolve EarnIn, Marqeta and Melio previously said TechCrunch is monitoring the incident for possible fallout.
LockBit initially claimed that the extortion incident was an attack on the U.S. Federal Reserve, perhaps because an affiliate spotted a stolen document labeled “United States Federal Reserve” and assumed the central bank was the target. The Board of Governors of the Federal Reserve System, in conjunction with the Arkansas State Bank Department, on June 14 released a cease and desist order against Evolve Bancorp and Evolve Bank & Trust, citing deficiencies in the bank’s “anti-money laundering, risk management and consumer compliance programs” (see: False: LockBit accuses Federal Reserve ransomware of targeting).