Cyber Incident Victim: First Horizon Corporation
Date:
Apr 2021
Location:
United States of America
Summary
First Horizon Corporation experienced a cybersecurity incident where attackers compromised a limited number of online banking accounts by leveraging stolen credentials and exploiting a third-party software vulnerability. The unauthorized access resulted in fraudulent withdrawals totaling under $1 million and exposure of customer information stored in the affected accounts. The financial institution reimbursed all impacted customers, notified regulators and law enforcement, remediated the exploited vulnerability, reset account passwords, and established new accounts for those affected. The company assessed that the breach would not materially impact its business operations or financial condition.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
First Horizon Corporation, a regional financial services company with $84 billion in assets, disclosed in April 2021 that unauthorized actors breached a limited number of online banking accounts belonging to customers of its subsidiary, First Horizon Bank. The incident was discovered in mid-April 2021, though the initial compromise occurred earlier that month. Attackers gained access by leveraging previously stolen customer credentials combined with exploitation of a vulnerability in unspecified third-party security software. This dual approach enabled unauthorized access to fewer than 200 online bank accounts. Once inside, threat actors extracted customer personal information stored within the accounts and initiated fraudulent transfers, ultimately obtaining less than $1 million in aggregate from affected customers. The bank emphasized the attack’s limited scope, noting no enterprise-wide system compromise beyond the targeted accounts.
Upon detection, First Horizon reimbursed all impacted customers for stolen funds and opened new banking accounts for them as a precautionary measure. The company notified relevant law enforcement agencies and data regulators, though specific entities were not named in disclosures. Remediation efforts included patching the exploited third-party software vulnerability and resetting passwords for compromised accounts. In an SEC 8-K filing dated April 28, 2021, First Horizon stated the incident would not materially affect its business operations or financial condition. This breach followed a separate 2020 disclosure by IBERIABANK Mortgage—a division acquired through First Horizon’s July 2020 merger—which involved a two-year data exposure unrelated to the credential-based attack. No additional technical specifics about the vulnerability or attacker identity were provided.