Class Action Lawyers Open Investigation Into Data Breach Involving Popular Fintech Companies

A hacker uses his computer in Dongguan, China's southern Guangdong Province, on Aug. 4, 2020. Nicolas Asfouri/AFP via Getty Images

Evolve Bank & Trust was breached in a cyberattack in May during which hackers stole the personal information of customers, and a law firm says it’s looking into potential claims for the data breach.

“[A] third party gained unauthorized access to personal information and financial information of Evolve retail banking customers and the customers of its financial technology partners,” the Memphis, Tennessee-based bank said in a June 25 filing with the U.S. Securities and Exchange Commission.

The stolen information includes customers’ names, Social Security numbers, bank account numbers, and contact information. Personal information of Evolve employees also likely was affected.

On July 2, law firm Schubert Jonckheer & Kolbe LLP said it is investigating the data breach, claiming that “millions of financial records” were breached.

People affected by the breach are at risk of identity theft, financial fraud, and other serious privacy violations, the firm warned. As such, these individuals could be entitled to monetary damages, it stated.

The law firm, which specializes in class action lawsuits against corporations, said the hacking group claimed that “33 terabytes of juicy banking information” was stolen and released to the dark web.

“As a fintech firm, Evolve partnered with numerous other companies, including Affirm, Bilt, Shopify, Mercury, Plaid, and Stripe,“ the firm stated. ”If you did business with any of these companies, your private information may have been posted on the Dark Web as part of the Evolve breach.”

In a June 27 post on social media platform X, fintech firm Mercury confirmed that its customers were affected by the Evolve hack. It said customers’ Mercury account credentials, including passwords, hadn’t been compromised and only information stored with Evolve was leaked.

Financial technology company Wise also confirmed the breach. Wise worked with Evolve between 2020 and 2023.

In a July 3 update, the bank said it’s scheduled to send notifications of the data breach to customers beginning on July 8. The initial round of notifications is expected to be completed over two weeks.

Evolve claims that all affected U.S. customers will receive two years of credit monitoring and identity protection services. International residents will receive dark web monitoring services.

The notifications will offer detailed information about these services and provide contact details to help customers address issues related to the data breach.

The ransomware attack was attributed to a hacking group called LockBit.

“They appear to have gained access to our systems when an employee inadvertently clicked on a malicious internet link,” the company stated. Evolve refused to pay the ransom demanded by the hackers, following which the criminals released the stolen data.

Evolve officials didn’t respond by press time to a request by The Epoch Times for comment.

LockBit Threat

LockBit is a ransomware group with links to Russia, according to software firm Blackberry.

While the FBI hasn’t explicitly called LockBit a Russian-backed group, “an assessment of LockBit’s public communications—which espouse a broadly anti-Western political view—indicates they have Russian origins with global affiliates,” BlackBerry said in a post.

LockBit-named ransomware was first observed on Russian-language cybercrime forums in January 2020, according to the U.S. Cybersecurity and Infrastructure Security Agency (CISA).

Since 2020, LockBit has been involved in roughly 1,700 attacks in the United States, CISA said in a June 2023 advisory. Roughly $91 million in ransom payments have been made to the group.

In 2022, 16 percent of state, local, tribal, and tribunal government ransomware incidents reported to the Multi-State Information Sharing and Analysis Center were identified as coming from LockBit.

Prudential Financial is another financial institution that was hacked recently. In February, Prudential revealed a cyberattack that compromised the data of more than 2.5 million people. The hack was attributed to the ALPHV ransomware group.

Private information such as names, other personal identifiers, and driver’s license and non-driver identification card numbers were stolen in this breach. Law firms are investigating claims for this incident.