Tri Counties Bank

Tri Counties Bank, also known as TCB, is a financial institution headquartered in the United States, specifically operating within California. It provides banking services to consumers and businesses across its network. The bank maintains a significant physical presence, operating more than 70 branch locations primarily within its Californian market area. Its core activities involve managing customer accounts, processing transactions, and handling sensitive financial and personal information, placing it squarely within the regulated financial services sector.

The bank has been significantly impacted by cybersecurity incidents, highlighting its position as a target for sophisticated cybercriminals. In February 2023, TCB suffered a cyberattack attributed to the Black Basta ransomware group, resulting in a confirmed data breach. Attackers published stolen customer identity documents, including passports and driver's licenses, demonstrating the compromise of highly sensitive personal data. This attack caused system outages affecting ATM access, although the direct link to the ransomware incident remained under investigation. The Black Basta group, known for its connections to the Conti ransomware operation and use of malware like Qakbot, targeted the bank among other financial entities. Subsequently, in March 2023, TCB was targeted by another ransomware attack, potentially exposing confidential customer data and forcing the bank to shut down its network segments. While the specific types of compromised information in this later incident were undetermined at the time of reporting, attackers claimed to possess and posted sensitive customer data. These consecutive incidents prompted TCB to notify authorities, engage third-party forensic experts to investigate the breaches' full scope, and prepare to issue breach notifications to affected individuals if unauthorized access to consumer information was confirmed. The bank's response involved initiating internal investigations to ascertain the extent of data compromise following both attacks.