Evolve bank to pay $11.9 million in data breach settlement

Evolve Bank & Trust has agreed to an $11.9 million settlement in a class action lawsuit stemming from a 2024 data breach that affected approximately 18 million individuals. The settlement resolves claims that the bank failed to adequately protect customer data.

Breach details and aftermath

The breach, a ransomware attack attributed to the LockBit hacker group, occurred between February and May 2024. Customer information was accessed and downloaded during this period. Evolve Bank notified affected customers of the breach on June 26, 2024.

According to court documents from the U.S. District Court for the Western District of Tennessee, the class action lawsuit consolidated 34 individual lawsuits related to the incident. Individual claimants may request settlements up to $3,000.

In a statement, an Evolve Bank spokesperson said, “There was no evidence that the criminals accessed any customer funds. The security team remediated the vulnerability, further strengthened its security response protocols, policies and procedures, and our ability to detect and respond to suspected incidents to further unauthorized access. We look forward to putting this behind us and moving forward with our business operations.”

Broader implications for fintech security

This settlement highlights the significant cybersecurity challenges facing financial institutions and their fintech partners. The financial sector is a prime target for cyberattacks, making robust data protection measures and incident response plans essential.

The Evolve Bank data breach occurred alongside a separate issue involving the bank and several fintech companies (Yotta, Juno, and Copper) due to the bankruptcy of Synapse, a middleware firm. This situation left thousands of customers unable to access their funds, further underscoring the complexities of security and operational resilience in the fintech ecosystem.