Hilltop Bank

Summary

Hilltop Bank experienced a cybersecurity incident that forced it to take its primary and backup systems offline, disrupting online and mobile banking for approximately a week. The bank limited debit‑card transactions to $1,000 per day, suspended scheduled outgoing payments such as mortgages and credit‑card bills, and pledged to reimburse customers for any late fees incurred. While seven of its eight branches reopened for limited in‑person services and ATMs remained operational, the core digital channels stayed unavailable and the institution provided no detailed timeline for full restoration. Officials said they disconnected systems as a precaution, worked with federal agencies and cybersecurity experts, and notified regulators, but have not disclosed whether malware, stolen credentials or data exfiltration was involved. Scammers have also attempted to spoof the bank’s call‑center number, prompting warnings to customers to rely only on official communications.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

Hilltop National Bank, a Casper, Wyoming bank with about $1.14 billion in assets and $987.6 million in deposits across eight offices, began experiencing IT problems on Sept. 8, 2026. Customers reported losing access to online banking as early as Monday night, and the bank announced Tuesday morning that online banking, mobile banking, and phone service were interrupted. The bank later raised debit-card limits to $1,000 per day so customers could still make purchases and ATM withdrawals. By Tuesday afternoon, Hilltop said it was still working to resolve the issues and apologized for the inconvenience. Overnight into Sept. 9, staff determined that the disruption was a cybersecurity incident. On Wednesday, Hilltop closed all branches and offices and disconnected both its primary and backup systems from the internet as a precaution to contain the issue. A bank spokesman said the backup systems were unplugged so they would not be affected. Hilltop said it had no projected time for restoring systems and said the priority was to make sure systems were no longer compromised and were fully operational before bringing them back online.

The shutdown removed access to most normal banking services. Online and mobile banking stayed offline, the bank’s main website remained down, and customers could not rely on scheduled transfers from Hilltop accounts for items such as car payments and credit-card payments. Hilltop initially told customers that scheduled outgoing payments for mortgages, auto loans, and credit-card bills would not be sent while systems were offline, although payments pulled directly by lenders would continue. The bank said it would reimburse customers for late charges or fees caused by the incident. Debit-card transactions were capped at $1,000 per day across stores and ATMs. Direct deposits were still arriving, and the bank’s question-and-answer page said customers would have access to their funds, though it did not explain how. The disruption affected more than individual customers; Cowboy State Daily reported that the town of Bar Nunn, which used Hilltop for payroll, had to work with the bank to ensure employees could be paid.

Hilltop began restoring limited operations after the initial shutdown. All offices were closed on Sept. 9, five reopened the next day, and seven of eight offices were open by Monday for a narrow set of transactions. Those reopened offices handled deposits, withdrawals, checks issued by the bank, and limited cash back on other checks. ATMs returned to service, and phone service was restored before other systems. The bank opened a call center on Sept. 10 and staffed it from 9 a.m. to 5 p.m. on weekdays. Because its main website was down, Hilltop used a separate incident update site to post status information. The bank also warned customers that scammers were spoofing the call center’s telephone number and told customers not to answer incoming calls displaying that number.

As of mid-September, Hilltop had not said when online or mobile banking would return. The bank also had not disclosed whether malware, stolen credentials, or another intrusion was involved, whether customer data was accessed or removed, or whether an extortion demand was made. No cybersecurity gang had claimed Hilltop as a victim on a leak site, and ransomware.live listed nothing for Hilltop as of Tuesday; the bank had not called the incident ransomware. Hilltop notified the Office of the Comptroller of the Currency and the Federal Reserve Bank of Kansas City about the incident. The bank said it was working with federal agencies, appropriate law enforcement, and cybersecurity professionals. Hilltop also stated that all accounts were insured by the FDIC up to established limits.

Sources

Sources available to members: 3 sources.