The 2024 Evolve data breach and the multidistrict litigation

analysisAccording to the bank's substitute notice of August 27, 2024, Evolve found in late May 2024 that some systems were not working properly and then established a ransomware attack by the LockBit group, which appears to have gained access when an employee clicked a malicious link. The attackers downloaded customer information from databases and a file share in February and May 2024 and encrypted some data; the bank stopped the attack, saw no new unauthorised activity after May 31, reported to law enforcement and refused to pay, and the stolen data was leaked. It said there was no evidence that customer funds were accessed. ¹

analysisThe affected data appeared to include names, Social Security numbers, account numbers, dates of birth and contact details of most of its personal, mortgage, trust and small-business customers and of customers of its Open Banking partners, debit card numbers for a small portion, and ACH records with payors' and payees' names and account and routing numbers. Notices began on July 8, 2024 with two years of credit monitoring. Its notice to Maine's attorney general reports a breach on February 9, 2024, discovered on May 29, affecting 7,640,112 people, 20,970 of them in Maine; the retained copy is an archived web copy of the state's listing. ^{1 2 3}

analysisPartners reported effects on their own customers: Dave says members' names, Social Security numbers, account numbers, dates of birth and contact details were disclosed, an online encyclopedia records that Affirm, Mercury and Wise told customers they were affected and that Mercury account numbers and balances were exposed, and Affirm cites the incident as an example of third-party risk. ^{4 5 6 7}

analysisAfter multiple putative class actions against Evolve and fintech partners, the Judicial Panel on Multidistrict Litigation created MDL No. 3127, In re: Evolve Bank & Trust Customer Data Security Breach Litigation, on October 4, 2024, before Chief Judge Sheryl H. Lipman in the Western District of Tennessee; the docket lists Affirm, Branch Messenger, CapitalJ and Yotta Technologies as defendants alongside Evolve. The January 2025 consolidated complaint alleged negligence, breach of third-party-beneficiary contract, unjust enrichment and California statutory claims; these are allegations, and the court made no finding of liability. ^{1 2}

analysisAfter a mediation on January 31, 2025 the parties agreed to settle. The court-approved notice offers class members reimbursement of documented losses up to $3,000 or a flat payment estimated at $20, plus credit monitoring, and says class counsel may seek fees of up to one-third of the fund, stated as $3,789,475.79; the notice's retained text does not state the fund total, which a class-action news site reported as $11.9 million. Evolve denies any wrongdoing, and the notice states that no court has found otherwise. The final hearing was set for November 14, 2025, and on November 13 the court denied an objector's motions to halt final approval; the outcome of the final hearing is not in the retained record. ^{3 2 4}