Evolve Bank and Trust confirms LockBit stole 7.6M people's data • Hacker News Board

Re: Evolve Bank and Trust confirms LockBit stole 7.6M people's data

#41

Post by trollbridge » Tue, Jul 09, 2024, 6:39 PM UTC

scrollaway wrote: post #35

gen3 wrote: post #34

Earlier quoted context omitted.

I received the same thing. What they don’t say is if your routing/account number used in transfers to/from your Wise account has been leaked. Same for any KYC info that the bank might need, such as name or SSN.

The EBT routing and account numbers are no longer valid since they migrated so even if they leaked that is irrelevant. But you’re right about personal data, I suspect names leaked.

And Evolve has allegedly been sending cease-and-desists to journalists who wanted to look at the leaked data:

https://techcrunch.com/2024/07/02/evolve-bank-sent-a-cease-a...

Journalists are the only ones at this point giving us any transparency into the whole situation.

Re: Evolve Bank and Trust confirms LockBit stole 7.6M people's data

#42

Post by tombert » Tue, Jul 09, 2024, 6:41 PM UTC

aketchum wrote: post #27

trollbridge wrote: post #12

Earlier quoted context omitted.

An act of Congress (I believe it was Dodd-Frank) capped debit card fees at a very low amount (fractions of a precent). An exception was left in for small banks to continue to charge credit-card-like rates for debit cards, around 2%. Since then, every fintech has had essentially the same business model: - Come up with some kind of "innovative" thing to sell consumers on that results in them generating debit card trans…

There are plenty of reasons to partner with a bank as a fintech other than to drive debit card revenue. 1. There are lots of regulations that say only banks can do certain actions, like lend in all 50 states under the rules of a single state. Or open a FDIC insured checking account. Or have a unique account+routing number for each user to send ACH funds to (various reasons this could be preferred to everyone ACH to o…

My last job's [1] basic premise was trying to get around this by using their VC money to simply buy a struggling-but-still-FDIC-approved bank, and then try and make a fintech on top of that. It seems like that skirted a lot of the issues that most fintechs have to deal with.

[1] It is not hard to find my work history but I politely ask you do not post it here.

Re: Evolve Bank and Trust confirms LockBit stole 7.6M people's data

#43

Post by sillysaurusx » Tue, Jul 09, 2024, 6:54 PM UTC

Animats wrote: post #28

Evolve is the bank that actually holds the assets for Synapse, the money-transfer company that shut down recently. That was on HN a few days ago.[1] Are these incidents related? [1] https://news.ycombinator.com/item?id=40877346

Doubtful, if only because data breaches never(?) kill companies.

Thanks for pointing that article out. It made me reconsider whether it’s wise to keep money in Mercury.

EDIT: this rabbit hole goes deep. https://techcrunch.com/2024/05/16/a-us-trustee-wants-trouble... "San Francisco-based Synapse, which operated a platform enabling banks and fintech companies to develop financial services, was founded in 2014 by Bryan Keltner and Pathak. It was providing those types of services as an intermediary between banking partner Evolve Bank & Trust and business banking startup Mercury, among others."

Mercury is by far the best bank I’ve ever used. But they’re not actually a bank, just a partner to one, and the foundations seem shakier than they appeared.

I hadn’t really stopped to consider "what if Mercury goes out of business?" till now. Silicon Valley Bank seemed like a one-off disaster, but now I’m not so sure.

Is there any bank that isn’t awful? Even just reliable wire transfers was beyond the capabilities of US Bank, for example, and it was a business account.

Re: Evolve Bank and Trust confirms LockBit stole 7.6M people's data

#44

Post by nicholasjarnold » Tue, Jul 09, 2024, 7:00 PM UTC

toomuchtodo wrote: post #17

cal5k wrote: post #15

Earlier quoted context omitted.

The key to keeping debit card fees down isn't to legislate a fee cap, it's to make payment rails more open and competitive. Why are regulators still attacking stablecoins, for example, when they represent one type of innovation that could actually lower transaction costs? Creating a legislative framework that encourages innovation rather than stifles it would make a lot more sense than trying to micromanage fees.

https://news.ycombinator.com/item?id=36801491 ("HN: FedNow Is Live") https://www.frbservices.org/financial-services/fednow/organi... https://explore.fednow.org/explore-the-city?id=3&building=ne... $25/month to plug into FedNow instant payment rails, 5 cents to move up to $100k in value (initial limit, max is $500k), 20 second settlement SLA.

Yep, FedNow is a good step in the right direction, but the list of banks that participate needs to grow substantially. Many small and mid-sized banks/FIs aren't having a great 2023/2024, so I wouldn't expect to hear much about them integrating with new payment rails until their fundamental economics improve a bit allowing the decision makers to loosen up the purse strings again.

source: have worked in the industry consulting and doing technical design and implementation

Re: Evolve Bank and Trust confirms LockBit stole 7.6M people's data

#45

Post by n_ary » Tue, Jul 09, 2024, 7:03 PM UTC

Not saying that this breach is somehow connected, but all of my Wise cards(both physical and virtual) got charged($10, $100, $500) at random locations of the globe in May & June and method was manual entry. While some charges were declined initially because the expiry date was entered wrong on first try(all of my cards coincidentally have expiry date like 04/24 or similar) but cvv was always correct. To make matters worse, all these charges were manually entered somewhere and NO approval notification(thing that I get when I make any online Txn, regardless of amount) ever popped up. I only noticed the declined txns in the evening when I went to check my phone after work.

Wise sent me an email this month that there was a breach at Evolve but all ties were broken with them and no data was affected. But these random rise of fraud txn were saying otherwise. Also, thankfully, the txns were declined due to insufficient fund(I only use wise during travelling and add fund before departure) which gets me extra worried that those might have gone through if I had funds even when all of those cards were frozen[1].

[1] This is my typical habit after getting one of my real credit card with very high limits getting charged thousands of Euros while I was out sick in hospital for a month and then getting greeted by all these charges while I was barely able to sit still and still recovering. Thankfully, my creditcard provider accepted my paperwork and removed(reversed?) those txn and immediately sent me a replacement card in a week and disabled my hacked card. Since then, I always keep my CC frozen and only use proxy(Wise) when doing txn online with limited balance.

Re: Evolve Bank and Trust confirms LockBit stole 7.6M people's data

#46

Post by aketchum » Tue, Jul 09, 2024, 7:05 PM UTC

trollbridge wrote: post #38

aketchum wrote: post #27

Earlier quoted context omitted.

There are plenty of reasons to partner with a bank as a fintech other than to drive debit card revenue. 1. There are lots of regulations that say only banks can do certain actions, like lend in all 50 states under the rules of a single state. Or open a FDIC insured checking account. Or have a unique account+routing number for each user to send ACH funds to (various reasons this could be preferred to everyone ACH to o…

(1) is absolutely true. (2) - well, it isn’t that hard to become a bank, but it is hard to become a bank when your business plan is “we want to operate well outside of established regulation and norms”. (Starting a state chartered bank is particularly straightforward.) There are many small banks that would like to be acquired and they are generally profitable. A VC-funded fintech would not have a terribly difficult t…

Sure - but that is buying a bank not forming a new bank. I do agree that in practice this is how well funded companies become banks.

Re: Evolve Bank and Trust confirms LockBit stole 7.6M people's data

#47

Post by [deleted] » Tue, Jul 09, 2024, 7:07 PM UTC

nicholasjarnold wrote: post #44

toomuchtodo wrote: post #17

Earlier quoted context omitted.

https://news.ycombinator.com/item?id=36801491 ("HN: FedNow Is Live") https://www.frbservices.org/financial-services/fednow/organi... https://explore.fednow.org/explore-the-city?id=3&building=ne... $25/month to plug into FedNow instant payment rails, 5 cents to move up to $100k in value (initial limit, max is $500k), 20 second settlement SLA.

Yep, FedNow is a good step in the right direction, but the list of banks that participate needs to grow substantially. Many small and mid-sized banks/FIs aren't having a great 2023/2024, so I wouldn't expect to hear much about them integrating with new payment rails until their fundamental economics improve a bit allowing the decision makers to loosen up the purse strings again. source: have worked in the industry co…

[deleted]

Re: Evolve Bank and Trust confirms LockBit stole 7.6M people's data

#48

Post by tristor » Tue, Jul 09, 2024, 7:13 PM UTC

This thread seems as good a place as any to ask. I have a Mercury account for a now defunct/non-existent company, but Mercury refused to close my account. Unfortunately that means I was exposed in this breach. What is the best way to get them to actually close my account? I no longer even have access to the account because it's tied to a domain and email that no longer exist. The business entity was shut down correctly, so it legally no longer exists. Should I just let this ride?

My original plan was just to ignore it, but thanks to this breach I guess I can't continue to ignore it.

Re: Evolve Bank and Trust confirms LockBit stole 7.6M people's data

#49

Post by blakeburnette » Tue, Jul 09, 2024, 7:22 PM UTC

Animats wrote: post #28

Evolve is the bank that actually holds the assets for Synapse, the money-transfer company that shut down recently. That was on HN a few days ago.[1] Are these incidents related? [1] https://news.ycombinator.com/item?id=40877346

The data breach did not cause the collapse of Synapse. Synapse has been a slow rolling collapse for the past 2ish years due to horrible management. Ultimately Synapse imploded when Mercury left Synapse as a BaaS provider to partner directly with Evolve BT. The Synapse collapse definitely put Evolve into the spotlight as someone with a ton of turmoil, lack of sufficient oversight and insufficient technological governance.

Evolve is an otherwise obscure bank chartered in Arkansas but headquartered in Tennessee (a little sketchy) that has over-leveraged itself. This is why it was hit with a Cease and Desist from the FDIC. The C&D also probably contributed to them becoming a target for LockBit.

Evolve is also the underlying bank for Stripe Treasury, although to my knowledge, their have been no new partnerships with them. I have heard the number 2 thrown around. Of note, Shopify is the main person for whom this was built and uses this.

Consequently if you have submitted KYC/KYB information for Shopify, Mercury, Yotta, Dave, any other past Synapse partners, or some Modern Treasury partners your data was breached. This seems to be the primary information shared along with account and routing numbers. This becomes problematic especially as part of the check involves external account and routing numbers along with SSN of any UBOs.

Fintechs do not partner with small banks because of debit card fees but because of Dodd Frank regulations (primarily).

Re: Evolve Bank and Trust confirms LockBit stole 7.6M people's data

#50

Post by sillysaurusx » Tue, Jul 09, 2024, 7:46 PM UTC

blakeburnette wrote: post #49

Animats wrote: post #28

Evolve is the bank that actually holds the assets for Synapse, the money-transfer company that shut down recently. That was on HN a few days ago.[1] Are these incidents related? [1] https://news.ycombinator.com/item?id=40877346

The data breach did not cause the collapse of Synapse. Synapse has been a slow rolling collapse for the past 2ish years due to horrible management. Ultimately Synapse imploded when Mercury left Synapse as a BaaS provider to partner directly with Evolve BT. The Synapse collapse definitely put Evolve into the spotlight as someone with a ton of turmoil, lack of sufficient oversight and insufficient technological governa…

Wow, Mercury’s account and routing numbers were all leaked, along with all KYC info? Is there a way to confirm that?

Their email made it sound much less serious.

(Apropos nothing, sorry about your motorcycle accident — I hope you’ve recovered well. Thank you for this comment; the severity of this breach wasn’t apparent till now.)