Evolve Bank Settles Lawsuits For Data Breach Affecting Over 18 Million Customers

Evolve Bank & Trust has agreed to pay $11.8 million to settle proposed class-action lawsuits stemming from a 2024 data breach. Gabrielle Saulsbery reports in BankingDive that the breach exposed the personal data of over 18 million individuals and triggered numerous class actions, which are settled by the In Re: Evolve Bank & Trust Customer Data Breach Litigation Settlement Agreement.

The settlement allows affected individuals to claim up to $3,000 each. While Evolve denies wrongdoing, it opted to avoid prolonged litigation and harm to its reputation.

The trouble began with the bankruptcy of Synapse, a firm that provided software that acts as an intermediary layer between operating systems and the applications running on it. Synapse’s software connected the fintechs Yotta, Juno, and Copper to Evolve and several other banks.

The breach occurred between February and May 2024 when the hacker group LockBit infiltrated Evolve’s systems through a ransomware attack. The bank discovered the breach in May after identifying system irregularities and notified customers on June 26.

The lawsuit, filed in the U.S. District Court for the Western District of Tennessee, consolidates 34 separate class actions. The plaintiffs alleged that Evolve had inadequate cybersecurity measures, failed to notify victims promptly, and profited from using improperly protected data.

Evolve maintains there is no evidence customer funds were accessed. However, the bank has enhanced its cybersecurity protocols in response. The proposed settlement awaits final court approval.

Attorneys should take note of the third-party risks involved when mutual software providers hold data from several institutions. Counsel advising financial clients should emphasize robust data protection policies, timely breach response strategies, and the need for thorough due diligence in banking-fintech partnerships.