Data breach exposes pitfalls of customer identification regulations

Guest 931 · Jul 16, 2024

YAËL OSSOWSKI
JULY 16, 2024

One of the most consequential bank hacks of the last few years was just revealed to the public. In a post uploaded to its website two weeks ago, the Arkansas-based Evolve Bank and Trust informed its customers that a “cybersecurity incident” involving Russian ransomware group LockBit resulted in the theft of an unspecified amount of customer information.

The hacker group, which has been the target of an international law enforcement operation for years, had originally claimed the hack was of the Federal Reserve, raising some eyebrows on Wall Street.

Instead, as the group’s dark net website reveals, the stolen cache of records allegedly relates to Evolve Bank and Trust customers and those at partner FinTech companies, reportedly including names of customers, Social Security numbers, dates of birth, and scans of driver's licenses and IDs.
[…]
Many key financial services firms, including big names like Wise, Mercury, Stripe, Affirm, and many more, have already communicated to their customers that some of their data may have been included in the hack. I have personally received some of these emails from other accounts.
[…]
Two factors make this alleged Evolve hack so devastating.

First, the scale and scope of the companies involved. The list of FinTech partners using Evolve’s banking license to issue financial accounts includes some of the largest institutions in the country, serving hundreds of millions of Americans. We will only know the true number of people affected once companies disclose whose data was compromised.

Second, federal laws required each company to collect significant personal and private data from its clients to provide to Evolve. Whether under the Bank Secrecy Act, the PATRIOT Act, the FDIC Customer Identification Program, Dodd-Frank Act, or the newly passed Corporate Transparency Act, the federal government mandates that customers hand over vast amounts of information and data that banks and financial institutions must retain to track down crime.

To comply with the myriad Know Your Customer and anti-money-laundering laws the government has imposed on financial institutions, each of these companies must collect and store the names, addresses, Social Security numbers, and ID scans of their customers to report to the Treasury Department. A nefarious Russian hacking group may now possess this information.
[…]
Click to expand...

https://www.theblaze.com/columns/op...tfalls-of-customer-identification-regulations

Log in or Sign up

Data breach exposes pitfalls of customer identification regulations

Guest 931 Guest

Log in or Sign up

Data breach exposes pitfalls of customer identification regulations

Guest 931 Guest

Useful Searches