Frost National Bank

Summary

Frost Bank suffered a breach after attackers infiltrated a shared third‑party vendor, exposing personal and tax‑related data of its customers. The compromised information included names, addresses, Social Security numbers, taxpayer identification numbers, mortgage interest records, W‑2 forms, 1099s and HSA contributions, affecting over 250,000 individuals. The ransomware group Everest posted the stolen data on its leak site, and class action lawsuits were filed shortly thereafter.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On April 20, 2026, the Everest ransomware group posted data from Citizens Financial and Frost Bank on its dark web leak site. The post indicated a same-day leak involving shared document-production data, pointing to a single-vendor compromise. Both banks subsequently confirmed that the breach originated at an unnamed third-party vendor and not within their own networks. The Massachusetts Attorney General’s data breach notification identified Everest ransomware via a shared third-party vendor as the cause.

Frost Bank reported that over 250,000 Social Security numbers and taxpayer identification numbers were compromised. The exposed data also included names, addresses, mortgage interest records, W-2 forms, 1099 forms, and HSA contribution details. Citizens Financial reported a separate scale of 3.4 million records, but the narrative focuses on Frost Bank’s impacted records. The breach affected individuals whose personal and tax information was stored by the vendor.

Following the disclosure, class action lawsuits were filed against Frost Bank within days. The breach was documented in a Massachusetts Attorney General data breach notification, which identified Everest ransomware via a shared third-party vendor as the cause. The incident contributed to the broader pattern of supply-chain compromises observed in April 2026, where attackers exploited trusted third-party relationships to gain access to multiple organizations simultaneously.

Sources

Sources available to members: 1 source.