Startups Rush to Gauge Impact of Evolve Bank Data Breach

On Wednesday, Evolve Bank and Trust, a key financial partner for numerous fintech startups, announced a significant data breach affecting both its retail and fintech partner customers. The breach, attributed to the notorious LockBit ransomware group, has raised concerns among Evolve's partner companies.

Evolve's communications chief, Thomas Holmes, confirmed that a known cybercriminal organization was behind the attack, and that stolen data had been released on the dark web. The breach impacts personal information and data of Evolve's customers and those of its fintech partners.

In response, TechCrunch reached out to several of Evolve’s partner companies, including Affirm, Airwallex, Alloy, Bond, Branch, Dave, EarnIn, Marqeta, Mastercard, Melio, Mercury, Prizepool, Step, Stripe, Tabapay, and Visa. Only Affirm, EarnIn, Marqeta, and Melio provided comments.

Affirm is investigating the incident and has informed affected customers, assuring them that their cards and Money Accounts remain safe to use. EarnIn and Marqeta are also monitoring the situation closely, with Marqeta noting that Evolve supports a minor part of their business. Melio is actively working with Evolve to assess any potential impact on their customers.

Fintech startup Mercury revealed on social media that the breach exposed some account numbers, deposit balances, business owner names, and emails. As more companies respond, the full extent of the breach’s impact will become clearer.

Evolve has faced regulatory scrutiny recently, with the Federal Reserve ordering the bank to improve its risk management practices around fintech partnerships and compliance with anti-money laundering laws. Additionally, Evolve was linked to the bankruptcy of Synapse, a banking-as-a-service startup, highlighting ongoing challenges in its fintech collaborations.