Flagstar Bank, National Association

Flagstar Bank, N.A. notified California residents of a data breach involving its third-party vendor, Fidelity Information Services (FIS). Unauthorized actors exploited vulnerabilities in MOVEit Transfer software to access customer files between May 27 and May 31, 2023. The incident resulted in the exfiltration of personal information, including names, addresses, and potentially financial account details. Flagstar offered two years of complimentary identity monitoring through Kroll. The vendor patched the vulnerabilities and conducted a technical review.