Flagstar Bank, National Association

Flagstar Bank experienced a data breach involving its third-party vendor, Accellion. An unauthorized party exploited a vulnerability in the Accellion file-sharing platform, gaining access to Flagstar's information between December 3 and December 4, 2021. Flagstar was notified of the vulnerability on January 22, 2021, and promptly took the server offline and discontinued use of the platform. Forensic investigation confirmed that certain files containing personal information were accessed and/or acquired. Flagstar engaged third-party forensic experts, notified law enforcement, and is providing two years of identity monitoring services to affected individuals through Kroll.