U.S. Bank

Summary

US Bank is investigating a LockBit ransomware claim that it breached the institution and stole undisclosed data, with the gang threatening to release the material unless a demand is met. The bank says it has found no evidence of unauthorized access and is reviewing logs, privileged activity, and vendor connections while monitoring for exposure. LockBit placed the bank on its leak site, giving a two‑week window to comply, though no proof of stolen files was provided. The claim follows earlier third‑party exposures that affected thousands of customers through vendors.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

US Bank is investigating claims by LockBit ransomware operation that it breached the institution and stole undisclosed data, as the group threatens to publish alleged material unless an extortion demand is paid by September 3. The bank said it is aware of the claims but has not confirmed that a compromise occurred. Lee Henderson, US Bank’s vice president of public affairs, said the organization is reviewing the situation and monitoring for potential exposure. Henderson stated that at this time there is no indication that internal systems are impacted and no evidence of unauthorized access to the network. The bank did not disclose whether it had engaged with LockBit, received a ransom demand, or identified the type and volume of data allegedly taken.

LockBit reportedly added US Bank to its data-leak site late Wednesday, granting the financial institution 14 days to meet its demands. The group’s listing did not include samples of the alleged stolen files, a file count, or details about affected systems, customers, or employees. The incident illustrates the continuing risk posed by ransomware groups using double-extortion tactics, wherein attackers steal data first and threaten public release if a victim declines to pay. Paying offers little assurance that stolen information will be deleted; law enforcement agencies that disrupted LockBit infrastructure in 2024 found evidence indicating the group had retained victim data even after receiving extortion payments. LockBit was one of the most prolific ransomware-as-a-service operations before Operation Cronos, the international law-enforcement action that seized servers, domains, and decryption keys in February 2024. Authorities later identified alleged LockBitSupp administrator Dmitry Yuryevich Khoroshev, who remains at large. Despite the disruption, the operation resumed activity, including the emergence of its LockBit 5.0 ransomware variant in late 2025.

The alleged breach arrives amid renewed scrutiny of third-party data exposures involving US Bank customers. In a separate vendor-linked incident disclosed earlier this year, the bank reportedly began notifying 537 Massachusetts customers that their names, mailing addresses, and credit card numbers may have been exposed through Fidelity National Information Services. According to The Register, that incident did not involve Social Security numbers, online banking credentials, or account balances. A law firm has nevertheless said it is considering a potential class-action case on behalf of affected individuals. US Bank has also faced a prior large-scale vendor-related exposure in 2022, when approximately 11,000 customers were affected after a third party accidentally shared a file containing information tied to closed US Bank credit-card accounts. The data reportedly included names, addresses, Social Security numbers, dates of birth, account numbers, and outstanding balances.

Sources

Sources available to members: 2 sources.