Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Evolve Bank and Trust confirms LockBit stole 7.6M people's data

theregister.com

Post reply on HN
Print view View original

31–40 of 83 posts

Re: Evolve Bank and Trust confirms LockBit stole 7.6M people's data

#31

Post by sixhobbits »

Temporary_31337 wrote: post #2

As the article explains any Wise (a fintech popular for travel debit cards and cheap intl money transfers) that had USD balance was exposed with the breach.

Yeah I think Wise new about this long before it became public. We had our USD receiving account details shut down with like 2 weeks notice which caused massive cashflow problems as we had to get all customers to redo payments.

And I know some people had it at like 1-2 days notice. I blamed wise at the time but I guess their hands were tied if they knew about this but weren't allowed to talk about it.

Re: Evolve Bank and Trust confirms LockBit stole 7.6M people's data

#32

Post by scrollaway »

gen3 wrote: post #20
scrollaway wrote: post #5

Earlier quoted context omitted.

That doesn’t seem right to me. Wise moved away from EBT a year or so ago. They may not be done moving away from them but my Wise USD balance is not with EBT anymore and they confirmed by email I was not affected by the breach.

How did you get them to confirm for you? The best I got was “Right now, we know it is possible some of your personal information may have been breached. We do not have further details to share, but we encourage you to stay vigilant in monitoring your financial activity. Please be advised that Wise remains secure, as is your account. This breach did not impact our systems. However, keep an eye on any suspicious activi…

Here is the email I received on June 28:

There’s been a data breach at Evolve Bank & Trust.

Evolve Bank & Trust is a regulated bank that we worked with from 2020 until 2023 to provide your old USD account details. They’ve recently been affected by a data breach and some of your personal information may have been involved.

This personal information does not include copies of any of the identification documents you’ve shared with us — these have not been shared with Evolve Bank & Trust at any point.

Your Wise account is safe We no longer work with Evolve Bank & Trust, and have already strengthened our security measures. We’ve also started a thorough investigation into this data breach and can confirm that it has not impacted our systems. This means:

• your Wise account credentials, including your password, are safe, and you can use your account as normal

• you can continue to use your USD account details — these are no longer connected to Evolve Bank & Trust

• you can continue to use any Wise cards you may have as they were not impacted by this issue – your card number and PIN are safe

Re: Evolve Bank and Trust confirms LockBit stole 7.6M people's data

#33

Post by [deleted] »

lowkey_ wrote: post #6

Can someone explain why in the world Evolve has my data? (I use Mercury and Wise for my company). I tried going to their website and I'm still completely clueless. Edit: Apparently Mercury was using Evolve as their banking partner. I know this is super common w/ online neobanks, but I'm really confused as to why they always choose the most random obscure bank. Why not partner with a major bank, or Column?

[deleted]

Re: Evolve Bank and Trust confirms LockBit stole 7.6M people's data

#34

Post by gen3 »

scrollaway wrote: post #32
gen3 wrote: post #20

Earlier quoted context omitted.

How did you get them to confirm for you? The best I got was “Right now, we know it is possible some of your personal information may have been breached. We do not have further details to share, but we encourage you to stay vigilant in monitoring your financial activity. Please be advised that Wise remains secure, as is your account. This breach did not impact our systems. However, keep an eye on any suspicious activi…

Here is the email I received on June 28: There’s been a data breach at Evolve Bank & Trust. Evolve Bank & Trust is a regulated bank that we worked with from 2020 until 2023 to provide your old USD account details. They’ve recently been affected by a data breach and some of your personal information may have been involved. This personal information does not include copies of any of the identification documents you’ve…

I received the same thing. What they don’t say is if your routing/account number used in transfers to/from your Wise account has been leaked. Same for any KYC info that the bank might need, such as name or SSN.

Re: Evolve Bank and Trust confirms LockBit stole 7.6M people's data

#35

Post by scrollaway »

gen3 wrote: post #34
scrollaway wrote: post #32

Earlier quoted context omitted.

Here is the email I received on June 28: There’s been a data breach at Evolve Bank & Trust. Evolve Bank & Trust is a regulated bank that we worked with from 2020 until 2023 to provide your old USD account details. They’ve recently been affected by a data breach and some of your personal information may have been involved. This personal information does not include copies of any of the identification documents you’ve…

I received the same thing. What they don’t say is if your routing/account number used in transfers to/from your Wise account has been leaked. Same for any KYC info that the bank might need, such as name or SSN.

The EBT routing and account numbers are no longer valid since they migrated so even if they leaked that is irrelevant. But you’re right about personal data, I suspect names leaked.

Re: Evolve Bank and Trust confirms LockBit stole 7.6M people's data

#36

Post by gen3 »

scrollaway wrote: post #35
gen3 wrote: post #34

Earlier quoted context omitted.

I received the same thing. What they don’t say is if your routing/account number used in transfers to/from your Wise account has been leaked. Same for any KYC info that the bank might need, such as name or SSN.

The EBT routing and account numbers are no longer valid since they migrated so even if they leaked that is irrelevant. But you’re right about personal data, I suspect names leaked.

I transferred funds between wise and my savings account. I assume my routing/account to my savings has been leaked

Re: Evolve Bank and Trust confirms LockBit stole 7.6M people's data

#37

Post by iudqnolq »

aketchum wrote: post #27
trollbridge wrote: post #12

Earlier quoted context omitted.

An act of Congress (I believe it was Dodd-Frank) capped debit card fees at a very low amount (fractions of a precent). An exception was left in for small banks to continue to charge credit-card-like rates for debit cards, around 2%. Since then, every fintech has had essentially the same business model: - Come up with some kind of "innovative" thing to sell consumers on that results in them generating debit card trans…

There are plenty of reasons to partner with a bank as a fintech other than to drive debit card revenue. 1. There are lots of regulations that say only banks can do certain actions, like lend in all 50 states under the rules of a single state. Or open a FDIC insured checking account. Or have a unique account+routing number for each user to send ACH funds to (various reasons this could be preferred to everyone ACH to o…

3. Smaller banks might be worse at preventing you from breaking the law.

(This data dump exposes lots of customers that should have triggered KYC issues, like an American dog-walking startup remotely operated from Pakistan )

Re: Evolve Bank and Trust confirms LockBit stole 7.6M people's data

#38

Post by trollbridge »

aketchum wrote: post #27
trollbridge wrote: post #12

Earlier quoted context omitted.

An act of Congress (I believe it was Dodd-Frank) capped debit card fees at a very low amount (fractions of a precent). An exception was left in for small banks to continue to charge credit-card-like rates for debit cards, around 2%. Since then, every fintech has had essentially the same business model: - Come up with some kind of "innovative" thing to sell consumers on that results in them generating debit card trans…

There are plenty of reasons to partner with a bank as a fintech other than to drive debit card revenue. 1. There are lots of regulations that say only banks can do certain actions, like lend in all 50 states under the rules of a single state. Or open a FDIC insured checking account. Or have a unique account+routing number for each user to send ACH funds to (various reasons this could be preferred to everyone ACH to o…

(1) is absolutely true.

(2) - well, it isn’t that hard to become a bank, but it is hard to become a bank when your business plan is “we want to operate well outside of established regulation and norms”. (Starting a state chartered bank is particularly straightforward.)

There are many small banks that would like to be acquired and they are generally profitable. A VC-funded fintech would not have a terribly difficult time acquiring a bank, particularly one that wants to offer BaaS, like Synapse did.

Re: Evolve Bank and Trust confirms LockBit stole 7.6M people's data

#39

Post by trollbridge »

lowkey_ wrote: post #26
trollbridge wrote: post #12

Earlier quoted context omitted.

An act of Congress (I believe it was Dodd-Frank) capped debit card fees at a very low amount (fractions of a precent). An exception was left in for small banks to continue to charge credit-card-like rates for debit cards, around 2%. Since then, every fintech has had essentially the same business model: - Come up with some kind of "innovative" thing to sell consumers on that results in them generating debit card trans…

> one of the major problems here is that small banks are often not staffed for adequate cybersecurity for global operations like these; they do just fine doing hometown community banking, but are very vulnerable to being cracked like this. Yet another reason small banks that are providing big-bank services should be regulated like big banks. Exactly — people are responding to me with comments about how SVB failed, or…

Or in this case, a bank based in West Memphis, _Arkansas_ that you’ve never heard of.

Re: Evolve Bank and Trust confirms LockBit stole 7.6M people's data

#40

Post by trollbridge »

Eridrus wrote: post #24
trollbridge wrote: post #12

Earlier quoted context omitted.

An act of Congress (I believe it was Dodd-Frank) capped debit card fees at a very low amount (fractions of a precent). An exception was left in for small banks to continue to charge credit-card-like rates for debit cards, around 2%. Since then, every fintech has had essentially the same business model: - Come up with some kind of "innovative" thing to sell consumers on that results in them generating debit card trans…

This doesn't seem to describe either Wise (international transfers, not an account) or Mercury (business banking where you can get your money out in a bunch of ways that do not involve debit cards).

Now that rates are higher, another fintech “opportunity” is anything that lets you sit on a large amount of money for a few days and collect 5% on it.

Of course, some fintechs actually are providing a legitimate service. I’d like to see them partnering with a legitimate bank directly instead of using an intermediary like Synapse which just dumped all the money in one FBO account.

Post reply on HN