Evolve Bank & Trust has provided detailed updates on its widely reported cybersecurity incident.
Evolve Bank & Trust claims that it is on schedule “to commence individual notifications starting July 8, 2024.”
These notifications will include “an offer of two years of comprehensive credit monitoring and identity protection services for U.S. residents, while international residents will be offered dark web monitoring services where available.”
Additionally, the notices will provide “detailed information on these services, along with instructions for registration and contact details for their dedicated call center, established to assist with enrollment and address any inquiries related to the incident.”
Evolve Bank & Trust’s initial round of notifications is “expected to be completed over approximately two weeks.”
As previously mentioned, their investigation “is ongoing, and they anticipate subsequent, smaller rounds of notifications.”
Evolve Bank & Trust says that they appreciate your ongoing patience “throughout this process and regret any inconvenience caused by this incident.”
The Evolve Team also noted on July 1, 2024, that they continue “to work around the clock to respond to the recent cybersecurity incident.”
They claim to be committed to transparency and have “provided a detailed update below about what happened, how they are responding, and actions you can take.”
They will continue to provide regular updates.
As reported widely, in late May 2024, Evolve Bank & Trust had reportedly “identified that some of its systems were not working properly.”
While it initially appeared to be a hardware failure, they “subsequently learned it was unauthorized activity.”
The claim to have engaged cybersecurity specialists “to investigate and determined that unauthorized activity may have been the cause.”
They “promptly” initiated their incident response processes, “stopped the attack within days, and have seen no new unauthorized activity since May 31, 2024.”
They engaged outside specialists to “investigate what happened and what data was affected, as well as a firm to help us restore our services.”
They reported this incident to law enforcement.
While the investigation is ongoing, they want to “share some important information about what we know so far.”
At this time, current evidence shows the following:
- This was a ransomware attack by the criminal organization, LockBit.
- They appear to have gained access to our systems when an employee inadvertently clicked on a malicious internet link.
- There is no evidence that the criminals accessed any customer funds, but it appears they did access and download customer information from our databases and a file share during periods in February and May.
- The threat actor also encrypted some data within our environment. However, we have backups available and experienced limited data loss and impact on our operations.
Evolve Bank & Trust says that they “refused to pay the ransom demanded by the threat actor. As a result, they leaked the data they downloaded.”
They also mistakenly attributed the “source of the data to the Federal Reserve Bank.”
Since becoming aware of the incident, Evolve Bank & Trust have “taken steps to enhance existing controls and further secure our environment,” including:
- Resetting passwords globally.
- Reconstructing critical Identity Access Management components, including Active Directory.
- Further hardening of firewall and dynamic security appliances.
- Deploying endpoint detection and response and other security tools to harden the network.
Evolve Bank & Trust says that they “are in the process of further strengthening our security response protocols, policies and procedures, and our ability to detect and respond to suspected incidents.”
At this time, Evolve Bank & Trust claim that they “have evidence that files were downloaded from their systems.”
The investigation is said to be “in its early stages, but it appears that names, Social Security numbers, bank account numbers, and contact information were affected for most of our personal banking customers, as well as customers of our Open Banking partners.”
They have now learned that personal information “relating to our employees was also likely impacted.”
They are still investigating what other personal information was affected, “including information regarding our Business, Trust, and Mortgage customers.”
Evolve Bank & Trust further claim that they “are committed to supporting our customers and partners through this process.”
To that end, they will be directly “notifying each individual whose personal information was affected and offering them two years of free credit monitoring and identity theft protection.”
The anticipate that they will begin “sending these individual notifications via email on July 8, 2024.”
These notices will also include details “regarding their dedicated call center, established to provide assistance enrolling in credit monitoring and answer questions about the incident.”
They encourage all personal banking customers and financial technology partners’ customers (end users) to “remain vigilant by monitoring account activity and credit reports.”