LockBit’s recent cyberattack on Evolve, a banking and fintech provider, underscores the vulnerability of the fintech sector to cyber threats. Claiming to have breached the U.S. Treasury, LockBit instead published 33 terabytes of data on the dark web, including personally identifiable information (PII) such as customer names, Social Security numbers, dates of birth, and account details. This breach, announced by Evolve on June 26, poses significant risks to affected individuals and organizations.
Evolve began notifying affected customers on July 8, tracing the incident back to a phishing email that led an employee to click a malicious link. “We refused to pay the ransom, resulting in the public release of the stolen data,” Evolve stated, clarifying that the information was wrongly attributed to the Federal Reserve Bank.
The attack sent shockwaves through the fintech startup community and its backers, including major names like Affirm, Mastercard, and Stripe. Affirm promptly informed its customers about potential fraudulent activities. Mercury detailed that the breach compromised sensitive information essential to their operations, while Evolve temporarily suspended its online banking services due to the incident.
Regulatory Warnings Preceded the Breach
The Federal Reserve's concerns about Evolve's risk management practices surfaced just two weeks before the breach. An examination earlier in 2023 revealed that Evolve had not adequately managed risks associated with its fintech partnerships. In response, the Federal Reserve mandated improvements to risk management processes to mitigate compliance and fraud risks.
However, Evolve's inability to fully comply with these measures may have exacerbated the breach's impact on its partners.
LockBit's Ransomware Tactics
LockBit's business model thrives on creating widespread chaos across supply chains to maximize payouts—with United Healthcare previously paying $22 million in ransom as a striking example. LockBit's Ransomware-as-a-Service (RaaS) model relies on recruiting affiliates while maintaining credibility through aggressive tactics.
Operation Cronos, an international law enforcement initiative, disrupted LockBit's operations earlier this year, recovering over 7,000 encryption keys. Nonetheless, the group continues its attacks, as demonstrated by the Evolve breach. Jon Miller, CEO of Halcyon, emphasizes the importance of cautious responses to ransomware claims, noting that attackers often fabricate victim lists to force ransom payments.
Data Security Insights for CISOs
Ofer Klein, CEO and co-founder of Reco, highlights the necessity of robust data permissioning and heuristics to enhance cybersecurity posture. Ransomware actors frequently use deceitful tactics to raise their profiles and ensure continued affiliate engagement.
Merritt Baer, CISO at Reco, notes that the threat of ransomware will persist. Businesses must focus on implementing fine-grained, behavioral data analytics to detect malicious activity before it escalates.
The Cost of Inaction
A CrowdStrike survey reveals 96% of ransomware victims who paid ransom also incurred additional extortion fees, averaging nearly $800,000, only to find their data sold or leaked online. Additionally, companies that paid ransom have faced penalties from the Office of Foreign Assets Control.
Board-Level Cybersecurity Leadership
Fortune 500 boards are increasingly prioritizing risk management to bolster cybersecurity strategies. Companies need a CISO who can effectively translate risk metrics into actionable strategies. George Kurtz, co-founder of CrowdStrike, advocates for CISOs to be perceived as enablers of business resilience.
Key strategies for strengthening fintech cybersecurity include:
1. Emphasizing Zero Trust: Eliminating unnecessary trust within tech stacks and enforcing least privilege access are essential for reducing cyber risks.
2. Comprehensive Monitoring: CISOs must ensure that network telemetry data is actively monitored to understand changing risk profiles.
3. Implementing Microsegmentation: This limits attackers' lateral movement within a network, reducing the potential impact of a breach.
4. Auditing Access Privileges: Conduct thorough audits to remove outdated credentials that can expose the network.
5. Default Multi-Factor Authentication (MFA): Enforcing MFA for all applications and platforms is crucial to preventing breaches.
Conclusion
The attack on Evolve highlights significant cybersecurity challenges in the fintech industry. As the Federal Reserve identifies gaps in risk management, organizations must prioritize adopting zero trust frameworks to enhance cyber resilience. The involvement of experienced CISOs on boards is critical to fortifying the security posture necessary for growth and stability in the fintech landscape.
As Baer cautioned, the urgency for heightened cybersecurity awareness remains ever-present—“security never takes a holiday.”
Ranking
