Evolve Bank data breach (2024): timeline and the partner data tests for BaaS programmes

The public timeline

Every row below comes from a dated public document. Evolve Bank & Trust, a state-chartered member bank of the Federal Reserve System in West Memphis, Arkansas, offers deposit accounts and payment processing to fintech companies through its Open Banking Division, according to the consent order. The exposed files held account data of the bank's own customers and of its fintech partners' end users.

The Maine count (7,640,112 persons) and the settlement class (17,880,046 individuals) come from different documents, and neither source reconciles the two numbers.

Evolve states that "it appears they did access and download customer information from our databases and a file share during periods in February and May", and that it "refused to pay the ransom" after which "they leaked the data they downloaded." The update of 6 August 2024 says "it appears that names, Social Security numbers, Evolve account numbers, date of birth, and contact information" for "most of our personal, mortgage, trust and small business banking customers, as well as customers of our Open Banking partners" were affected. The same update says "the affected files also included ACH transaction records, which include financial account number, routing number, and name for both payors and payees."

The cease and desist order is a separate matter. The Board's press release says it followed examinations "conducted in 2023" and addresses anti-money laundering, risk management, and consumer compliance. The order also requires a plan "to correct the information technology and information security deficiencies identified in the Reports of Examination" (paragraph 6). No source links those deficiencies to the intrusion, and this post does not either.

Failure class: partner data held at the partner bank

We file this incident under third-party and partner bank data exposure in BaaS. The fintech's own systems can be intact while its end users' data leaks from the bank. A Wise spokesperson told TechCrunch that "Wise's systems were not compromised". Wise still emailed customers it thought "may have been affected", and TechCrunch reports that Wise had shared U.S. customers' names, addresses, dates of birth, contact details, and Social Security or Employer Identification Numbers with Evolve.

Three facts from the sources define what a BaaS programme has to know about its own data:

• Former partners are in scope. Wise worked with Evolve "from 2020 until 2023", before the intrusion in February 2024, and still said some customers' personal information "may have been involved".
• Counterparties are in scope. ACH transaction records carry account number, routing number, and name "for both payors and payees". Each record names both sides of a payment, so the affected set can include people who hold no account at the bank or at the fintech.
• The partner-to-user map matters for notice. The court-authorised settlement FAQ states: "Unfortunately, we do not have information about specific customer's relationships with particular fintechs." A fintech that cannot list which of its users' records the bank holds cannot scope its own notice either.

The consent order points the same way from the supervisor's side. It requires the bank's plan to cover "onboarding, regular risk monitoring, and offboarding of OBD fintech partners and customers" (paragraph 3(a)(iii)(B)) and "the provision of sufficient information, data, and reports to senior management and the board of directors" (paragraph 3(a)(iii)(E)).

What testing can catch, and what it cannot

No test stops an employee from clicking a link, and no test prevents a ransomware group from operating. Evolve's own remediation list names "Reconstructing critical Identity Access Management components, including Active Directory", firewall hardening, and endpoint detection and response. Tests can verify the controls below, which decide how much partner data a single compromised workstation can reach, and how fast a fintech can answer "which of our users are in the leak". This is our test practice for fintechs on the BaaS segment, labelled as ours; no rule prescribes it.

The inventory test runs in CI on the fintech's side: the integration layer logs outgoing payload field names (never values), and the test fails on any field missing from the inventory. The same inventory, joined to user IDs, lists which users' records sit at which partner bank.

For test environments, synthetic records keep real identifiers out of non-production systems. The trade-offs are on our synthetic data versus masking comparison. The scan itself checks formats, for example nine-digit strings in Social Security number layout and nine-digit routing numbers that pass the American Bankers Association (ABA) check digit, and every hit is traced to its source table.

Access reviews and segmentation belong to security testing, where the deliverables include an access control and authorisation test matrix and a penetration test report. For a fintech, the questions go to the partner bank as part of due diligence: which segment holds our exports, who can read it, and when was that last tested. The partner bank integration scenario sets out the test evidence pack a partner bank receives before launch.