Michigan-based Flagstar Bank has added another 25,000 individuals to the number of people affected as a result of the MOVEit Transfer breach suffered by one of its vendors last year.
In a recent notice of data breach filed with the Office of the Attorney General of Maine, Flagstar Bank said that Fidelity Information Services, LLC (“FIS”), a third-party vendor the bank uses for payment processing and mobile banking purposes, used Progress Software’s MOVEit Transfer web application to send and receive files securely and was impacted after cyber criminals exploited a zero-day vulnerability in the application to access its users’ data.
Soon after being notified about the exploitation involving the file transfer application, FIS launched an internal investigation to understand the scope of the data security incident. The investigation revealed that “unauthorised activity in the MOVEit Transfer environment occurred between May 27 and 31, 2023, which was before the existence of this vulnerability was publicly disclosed.”
“The vulnerability discovered in MOVEit did not involve any of Flagstar Bank’s systems and did not impact our ability to service our customers,” the financial institution said.
The bank admitted that the files accessed by the Clop ransomware group, the hacker group responsible for the cyber security incident, contained the sensitive personal information of its customers. The compromised data included names and other personal identifiers such as Social Security Numbers.
The filing with the regulator also revealed that at least 25,891 individuals were affected by the data security incident. Prior to this filing, Flagstar said in a separate filing with the regulator that Fiserv, another third party vendor that the bank used for payment processing and mobile banking purposes, was also a victim of the MOVEit Transfer web application exploitation.
While the bank initially said that 849,223 individuals were impacted by the incident, in an updated filing with the Office of the Attorney General of Maine, the bank added 838,073 individuals to the number of people affected by the Fiserv breach.
“Upon learning of this incident, Flagstar took immediate action to ensure that our vendor had launched a comprehensive investigation, identified individuals affected and notified regulatory bodies as required,” the bank said.
“To help prevent something like this happening again our vendor has, through their service provider, remediated all technical vulnerabilities and patched systems in accordance with the MOVEit software provider’s guidelines.
“Our vendor’s service provider also mobilised a technical response team to examine the relevant MOVEit systems and ensure that there were no further vulnerabilities,” it added.
Flagstar Bank is providing two years of complementary credit monitoring, fraud consultation and identity theft restoration service through Kroll to all affected individuals whose data was compromised in the security incident.
