Evolve Bank & Trust

Documented events with consequences still open. Each entry carries a source and a date.

1. Jul 8, 2024 Data breach Critical ● open

   LockBit ransomware attack: names, Social Security numbers, account numbers and contact details of 7,640,112 people exfiltrated and published, including customers of the fintechs that run on the bank

   Evolve Bank & Trust is a US bank that sells almost nothing to the public: it works behind fintechs, issuing accounts and cards on their behalf. This incident therefore also concerns people who never heard the name "Evolve" and who were customers of an app. The chronology, as the bank itself tells it in its official notice: the attackers "accessed and downloaded customer information from our databases and a file share during periods in February and May" 2024. "In late May 2024, Evolve Bank & Trust identified that some of its systems were not working properly": it looked like a hardware failure, it was an intrusion. The bank states it has seen "no new unauthorized activity since May 31, 2024". The way in, admitted by the bank, is the most ordinary there is: "an employee inadvertently clicked on a malicious internet link". The perpetrator is named: "this was a ransomware attack by the criminal organization, LockBit". The ransom was not paid and the data was published: in late June 2024 LockBit released the stolen material, at first presenting it as a breach of the US Federal Reserve — a false claim, disproved in the following days when it became clear the data was Evolve's. That is why this case got far more visibility than it otherwise would have. The numbers and the perimeter. The formal notice of 8 July 2024 and the filings with state authorities put the number of people involved at 7,640,112. The exfiltrated data, according to the bank's notice, includes "names, Social Security numbers, bank account numbers, and contact information" for most retail customers "as well as customers of our Open Banking partners", plus information relating to employees and ACH transaction records; a smaller group also had their debit card number exposed. The Social Security number is what makes this case heavy and non-ageing: it is not a password, it cannot be changed. What did NOT happen: the bank states there is "no evidence that the criminals accessed any customer funds". The money in the accounts was not touched — what got out were identities. Remedies offered: individual notification to those affected and two years of credit monitoring and identity theft protection for US residents, with a dedicated phone line. Why it still matters today, two years on: the data was published, so it is permanently in circulation, and a person's Social Security number cannot be revoked. For a European reader the direct risk is low — the perimeter is American — but the case is worth reading for something that concerns everyone: when you use a financial app, your documents also sit with the bank behind the app, which you did not choose and whose name you probably do not know.

   ↗ source
2. Jun 14, 2024 Regulatory action Severe ● open

   Cease and desist order from the Federal Reserve and the Arkansas State Bank Department: "unsafe and unsound" banking practices in the management of fintech partnerships, anti-money laundering and consumer protection

   On 14 June 2024 the Board of Governors of the Federal Reserve System, together with the Arkansas State Bank Department, issued a cease and desist order against Evolve Bancorp, Inc. and its subsidiary Evolve Bank & Trust. It is not a fine: it is an order to fix things and to show they have been fixed. The content is the point. According to the Federal Reserve, examinations conducted in 2023 and a follow-up review in early 2024 found that the bank "engaged in unsafe and unsound banking practices by failing to have in place an effective risk management framework" for its partnerships with fintech companies, and that it "did not maintain an effective risk management program or controls sufficient to comply with anti-money laundering laws" and consumer protection laws. The order requires it to strengthen internal policies, the oversight and monitoring of those relationships, and its recordkeeping and consumer compliance procedures. It should be read in the context in which it arrived, without being confused with that context: in spring 2024 the collapse of technology middleman Synapse — for which Evolve was one of the partner banks — had left end customers of several apps without access to their own money for weeks, because of a mismatch in the ledgers between the parties. The Federal Reserve specifies that its action is independent of the Synapse bankruptcy proceedings: that order concerns the way the bank governed its own partnerships, it is not a finding of liability for the money frozen in that affair. Why it matters to readers of this registry: Evolve is not a brand you choose, it is the infrastructure under brands you do choose. An action saying the bank was not adequately overseeing its fintech partners is, translated, an action about the level of supervision applied to the accounts and cards those partners were selling to the public. Status: there is no indication that the order has been revoked or terminated. Compliance obligations of this kind are multi-year by nature and their closure is announced by the authority: until then this entry stays open. It is not an "ongoing" incident — nothing is happening right now — but it is not closed either.

   ↗ source

verified on Sep 26, 2026