Evolve Bank & Trust data breach (2024)

FEDERALSEC 8-KFirst filing

Filed Jul 1, 2024bd_0306a4446fc3494b

Affirm Holdings disclosed via Form 8-K that on June 25, 2024, Evolve Bank & Trust — the third-party issuer of the Affirm Card — notified Affirm of a cybersecurity incident in which an unauthorized third party accessed personal and financial information of Evolve's retail banking customers and fintech-partner customers, including Affirm Card users. Affirm's own systems were not compromised. Evolve indicated the incident was contained; Affirm launched an independent investigation, notified law enforcement and all Affirm Card users, and heightened fraud monitoring.

🥔Idaho State AGlinked via same-victim cross-source · 100%

Filed Jul 8, 2024bd_75a9fadea4599369

Evolve Bank & Trust notified Idaho AG on July 8, 2024, of a security event discovered May 29, 2024. Unauthorized actors accessed and downloaded customer data (names, SSNs, bank account numbers) in February and May 2024. Approximately 29,728 Idaho residents were affected. The bank stopped the attack, engaged forensic specialists, notified law enforcement, and offered 24 months of credit monitoring. No customer funds were accessed.

Affected (this filing): 29,728

🦞Maine State AGlinked via tight-window match · 100%

Filed Jul 8, 2024bd_859e2a8aac37b2ff

Evolve Bank & Trust, a Memphis-based financial services provider offering Banking-as-a-Service, experienced an external cybersecurity attack. Threat actors accessed and downloaded customer data from databases and a file share during periods in February and May 2024. The breach was discovered on May 29, 2024, and contained by May 31, 2024. Approximately 7,640,112 individuals were affected nationally; 20,970 Maine residents. Notifications sent July 8, 2024. No customer funds were impacted.

Affected (this filing): 20,970

ME AG >30d · 40d

🦬Montana State AGlinked via same-victim cross-source · 100%

Filed Jul 8, 2024bd_91935c803715a403

Evolve Bank & Trust reported a data breach to the Montana Attorney General. The breach was reported on 2024-07-08. The breach occurred from 5/1/2024 to 5/31/2023. 38,740 Montana residents were affected.

Affected (this filing): 38,740

🐻California State AG

Filed Jul 8, 2024bd_aa5d4b960051d1e4

Evolve Bank & Trust experienced a cybersecurity attack where threat actors accessed and downloaded customer information from databases and file shares during periods in February and May 2024. The incident was identified on May 29, 2024, and contained by May 31, 2024. No customer funds were accessed. Evolve engaged a cybersecurity firm, notified law enforcement, and is offering 24 months of credit monitoring to affected individuals.

CA 60-day OK · 40d

🌲Washington State AG

Filed Jul 8, 2024bd_fcb8a565ba7193c7

Evolve Bank & Trust, a finance sector entity reported a ransomware incident to the Washington Attorney General. The organization became aware of the incident on 2024-05-29 and filed notice on 2024-07-08. 275,716 Washington residents were affected. 40 days elapsed between awareness and notification. 110 days to identify the breach. 2 days to contain the breach.

Affected (this filing): 275,716

WA AG >30d

Evolve Bank & Trust

Litigation Timing

Affected residents by state

Timeline