Evolve Bank & Trust Data Breach Lawsuit Filed After Cybercriminals Reportedly Steal Consumer Info

New to ClassAction.org? Read our Newswire Disclaimer

Evolve Bank & Trust faces a proposed class action lawsuit in the wake of a reported data breach announced by the institution in late June 2024.

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter here.

The 59-page Evolve Bank & Trust data breach lawsuit says the bank announced publicly on June 26 that it was “currently investigating a cybersecurity incident involving a known cybercriminal organization,” later identified as LockBit, that apparently stole and posted on the dark web the sensitive personal information of some of Evolve’s current and former retail bank customers, including those with a Shopify Balance card, and those of its fintech partners.

Evolve Bank & Trust stated online that it is scheduled to begin sending individual notices to data breach victims on July 8, 2024. The notices will include two years of credit monitoring and identity theft protection services for U.S. residents, the bank said.

In its online disclosure, Evolve shared that there is no evidence that LockBit accessed any customer funds, though it appears “they did access and download customer information” from the bank’s databases and a file share during periods in February and May of this year. Per the suit, the compromised information included names, Social Security numbers, dates of birth, account information and other personal information. Evolve added that it “refused to pay the ransom demanded by the threat actor,” which the defendant said prompted the cybercriminals to leak the data they downloaded.

The proposed class action chides Evolve Bank & Trust for waiting until late June to provide victims with “the barest of notice” about the data breach, relaying only that a breach occurred, that their information was now available on the dark web thanks to a “known cybercriminal organization,” and that the data involved the most sensitive of personally identifiable information.

“Until this Notice, Plaintiffs and Class Members were unaware that their sensitive [personally identifiable information] had been compromised, and that they were, and continue to be, at significant risk of identity theft and various other forms of personal, social, and financial harm.”

The data breach lawsuit accuses Evolve of failing to appropriately protect consumers’ personally identifiable information, which was allegedly left unencrypted, unredacted and vulnerable to theft due to the bank’s “negligent and/or careless acts and omissions.” Evolve has a legal obligation to, and has represented that it will, safeguard the sensitive customer data in its possession, the complaint states. 

The case stresses that the risk of identity theft and fraud faced by Evolve Bank & Trust data breach victims will continue for their respective lifetimes due to Evolve’s alleged negligence.

According to the lawsuit, Evolve left out of its data breach notice the root cause of the hack, the reasons it took so long to discover the unauthorized intrusion and notify victims, the vulnerabilities exploited by the perpetrators, and the measures undertaken to ensure such a cyberattack does not happen again.

“This ‘disclosure’ amounts to no real disclosure at all, as it fails to inform, with any degree of specificity, Plaintiff and Class Members of the Data Breach’s critical facts. Without these details, Plaintiff’s and Class Members’ ability to mitigate the harms resulting from the Data Breach is severely diminished.”

The Evolve Bank & Trust data breach class action lawsuit looks to cover all United States residents whose personally identifiable information was accessed and/or acquired by an unauthorized party as a result of the Evolve data breach.

Are you owed unclaimed settlement money? Check out our class action rebates page full of open class action settlements.