EBT
Company Details
Linkedin ID:
evolve-bank-&-trust
Website:
Employees number:
546
Number of followers:
10,182
NAICS:
52
Industry Type:
Homepage:
getevolved.com
IP Addresses:
57
Company ID:
EVO_2462270
Scan Status:
Completed
Evolve Bank & Trust Company CyberSecurity Posture
getevolved.com
For a hundred years, Evolve Bank & Trust has been dedicated to delivering superior financial services. From our roots in Personal and Business Banking & Lending to our work as pioneers in the Banking-as-a-Service (“BaaS”) provider space, Evolve is recognized as a global leader. Nacha named Evolve a Top 50 ACH Originator, and Tearsheet named Evolve Partner Bank of the Year. Evolve has been voted a Top Workplace every year since 2013 and ranked on Inc. Magazine’s 5000 List of the fastest-growing private companies. Member FDIC. Equal Housing Lender. NMLS# 509256
Evolve Bank & Trust A.I CyberSecurity Scoring
EBT Risk Score (AI oriented)Between 0 and 549
EBT
Updated:
- Powered by our proprietary A.I cyber incident model
- Insurance preferes TPRM score to calculate premium
EBT Global Score (TPRM)XXXX
EBT
- Instant access to detailed risk factors
- Benchmark vs. industry & size peers
- Vulnerabilities
- Findings
EBT Company CyberSecurity News & History
Past Incidents
4
Attack Types
2
Evolve Bank
Breach
Rankiteo Explanation
Attack with significant impact with customers data leaks
Description: Evolve Bank & Trust suffered a security breach causing the compromise of personal information. The breach was announced by the LockBit gang, which allegedly exfiltrated 33 TB of sensitive data from the Federal Reserve and leaked documents belonging to Evolve Bank. Certain customers' personal data, including names, addresses, SSNs or EINs, dates of birth, and contact details were involved. The breach affected fintech firms Wise and Affirm, their customers, and potentially undermined the security and trust in Evolve's banking services. Although the bank's core systems like debit cards and digital banking credentials were reportedly not affected, the incident highlights the vulnerability of financial data in the interconnected fintech ecosystem.
Evolve Bank & Trust
Breach
Rankiteo Explanation
Attack with significant impact with customers data leaks
Description: The California Office of the Attorney General reported a data breach involving Evolve Bank & Trust on July 8, 2024. The breach was identified on May 29, 2024, when unauthorized activity was detected, leading to the potential exposure of customer information but no confirmed unauthorized access to funds.
Evolve Bank & Trust
Ransomware
Rankiteo Explanation
Attack threatening the organization's existence
Description: The Washington State Office of the Attorney General reported a data breach involving Evolve Bank & Trust on July 8, 2024. The breach, identified as a ransomware cyberattack, occurred between February 9, 2024, and May 31, 2024, potentially exposing the personal information of 275,716 individuals, including names, Social Security numbers, and financial information.
Evolve Bank and Trust
Ransomware
Rankiteo Explanation
Attack threatening the organization’s existence
Description: Evolve Bank and Trust, a financial institution catering to fintech startups, experienced a ransomware attack alongside a data breach with the potential to affect its customers and those of its fintech partners. A cybercriminal organization obtained and released private data on the dark web. LockBit ransomware group claimed responsibility for the theft and publication of sensitive information, disrupting banking operations, compromising client confidentiality, and undermining trust in Evolve's cybersecurity measures.
EBT Company Scoring based on AI Models
Cyber Incidents Likelihood 3 - 6 - 9 months
A.I Risk Score Likelihood 3 - 6 - 9 months
Underwriter Stats for EBT
Incidents vs Financial Services Industry Average (This Year)
No incidents recorded for Evolve Bank & Trust in 2025.
Incidents vs All-Companies Average (This Year)
No incidents recorded for Evolve Bank & Trust in 2025.
Incident Types EBT vs Financial Services Industry Avg (This Year)
No incidents recorded for Evolve Bank & Trust in 2025.
Incident History — EBT (X = Date, Y = Severity)
EBT cyber incidents detection timeline including parent company and subsidiaries
EBT Company Subsidiaries
For a hundred years, Evolve Bank & Trust has been dedicated to delivering superior financial services. From our roots in Personal and Business Banking & Lending to our work as pioneers in the Banking-as-a-Service (“BaaS”) provider space, Evolve is recognized as a global leader. Nacha named Evolve a Top 50 ACH Originator, and Tearsheet named Evolve Partner Bank of the Year. Evolve has been voted a Top Workplace every year since 2013 and ranked on Inc. Magazine’s 5000 List of the fastest-growing private companies. Member FDIC. Equal Housing Lender. NMLS# 509256
Loading...
EBT Similar Companies
Banco Falabella
Te invitamos a trabajar y disfrutar el Desafío de Crecer en Falabella Financiero, filial del Falabella, compañía con más de 125 años de trayectoria, conformada por Banco, CMR y Seguros Falabella, Fpay y CMR Puntos, con presencia en Chile, Perú, Colombia Argentina y México. En #FalabellaFina
Empower
Built on a foundation of trust, integrity and promise, we proudly serve over 71,000 outstanding organizations and more than 17 million individuals. ¹ We take great pride in helping people with saving, investing and advice, while providing them with the tools and resources they need to help reach the
HDB Financial Services (HDBFS) is a leading Non-Banking Financial Company (NBFC) that caters to the growing needs of an Aspirational India, serving both Individual & Business Clients The lines of business include - Lending and BPO Services. Incorporated in 2007, HDB is a well-established business wi
Wells Fargo
Wells Fargo & Company (NYSE: WFC) is a diversified, community-based financial services company with approximately $1.9 trillion in assets. Wells Fargo’s vision is to satisfy our customers’ financial needs and help them succeed financially. Founded in 1852 and headquartered in San Francisco, Wells Fa
S&P Global provides governments, businesses, and individuals with market data, expertise, and technology solutions for confident decision-making. Our services span from global energy solutions to sustainable finance solutions. From helping our customers perform investment analysis to guiding them th
Opening up a world of opportunity for our customers, investors, ourselves and the planet. We're a financial services organisation that serves more than 40 million customers, ranging from individual savers and investors to some of the world’s biggest companies and governments. Our network covers 58
Marsh McLennan
Marsh McLennan (NYSE: MMC) is a global leader in risk, strategy and people, advising clients in 130 countries across four businesses: Marsh, Guy Carpenter, Mercer and Oliver Wyman. With annual revenue of $23 billion and more than 85,000 colleagues,
Wells Fargo Advisors
With financial advisors serving our clients in all 50 states, Wells Fargo Advisors is headquartered in St. Louis. At the end of the day, we help our clients succeed financially. For us – our Financial Advisors and thousands of other team members – it's a commitment. It's about honoring our relation
FactSet
FactSet creates flexible, open data and software solutions for tens of thousands of investment professionals around the world, providing instant access to financial data and analytics that investors use to make crucial decisions. For 40 years, through market changes and technological progress, our
.png)
EBT CyberSecurity News
November 03, 2025 08:00 AM
An Evolving Situation (Hunter Field Editor’s Note)
Arkansas Business had just gone to press with a cover story quoting Evolve Bank & Trust CEO Bob Hartheimer when editors learned he'd been...
November 03, 2025 06:00 AM
Hires & Promotions at Evolve Bank, Washington Regional, Water Reclamation Authority (Movers & Shakers)
See the latest leadership changes in Arkansas banking, education, manufacturing, and more, including updates from Evolve Bank and UA Little...
November 02, 2025 07:00 AM
‘Want to trade nudes?’: Evolve Bank CEO fired after trying to meet 15-year-old boy for sex | Trending
Robert “Bob” Hartheimer has been fired from his role as chief executive officer of Evolve Bank after he tried to meet a 15-year-old boy for sex.
November 02, 2025 07:00 AM
US Bank CEO Meets 'Teen' For Sex, He Turns Out To Be FBI Agent
The CEO of a US financial companyhas been fired after being arrested in an FBI sting that allegedly caught him trying to meet someone he...
November 01, 2025 07:00 AM
Evolve Bank CEO fired after propositioning FBI agent who pretended to be a teen boy
Evolve Bank CEO fired after propositioning FBI agent who pretended to be a teen boy · Evolve Bank & Trust has fired CEO Bob Hartheimer after...
November 01, 2025 07:00 AM
Former Evolve CEO could face life in prison after allegedly soliciting sex
According to the complaint, there is probable cause for charges of child sexual exploitation and sending obscene materials to minors.
November 01, 2025 07:00 AM
Evolve Bank CEO Fired After FBI Sting on Dating App
Evolve Bank & Trust fired CEO Bob Hartheimer after federal agents arrested him for propositioning what he believed was a 15-year-old boy on...
October 31, 2025 07:00 AM
Evolve Bank’s New CEO Charged With Child Pornography Crimes
Federal officials have opened a criminal investigation into Bankim Brahmbhatt, who was sued by HPS and other lenders earlier this year. Continue...
October 31, 2025 07:00 AM
Evolve Bank CEO sought sex from 15-year-old boy on Grindr, used name 'Tom Little,' FBI says
Phone records linked those accounts to Hartheimer, according to the court records. Authorities identified Hartheimer's car and arrested him at...
Frequently Asked Questions
Explore insights on cybersecurity incidents, risk posture, and Rankiteo's assessments.
EBT CyberSecurity History Information
Official Website of Evolve Bank & Trust
The official website of Evolve Bank & Trust is http://www.getevolved.com.
Evolve Bank & Trust’s AI-Generated Cybersecurity Score
According to Rankiteo, Evolve Bank & Trust’s AI-generated cybersecurity score is 437, reflecting their Critical security posture.
How many security badges does Evolve Bank & Trust’ have ?
According to Rankiteo, Evolve Bank & Trust currently holds 0 security badges, indicating that no recognized compliance certifications are currently verified for the organization.
Does Evolve Bank & Trust have SOC 2 Type 1 certification ?
According to Rankiteo, Evolve Bank & Trust is not certified under SOC 2 Type 1.
Does Evolve Bank & Trust have SOC 2 Type 2 certification ?
According to Rankiteo, Evolve Bank & Trust does not hold a SOC 2 Type 2 certification.
Does Evolve Bank & Trust comply with GDPR ?
According to Rankiteo, Evolve Bank & Trust is not listed as GDPR compliant.
Does Evolve Bank & Trust have PCI DSS certification ?
According to Rankiteo, Evolve Bank & Trust does not currently maintain PCI DSS compliance.
Does Evolve Bank & Trust comply with HIPAA ?
According to Rankiteo, Evolve Bank & Trust is not compliant with HIPAA regulations.
Does Evolve Bank & Trust have ISO 27001 certification ?
According to Rankiteo,Evolve Bank & Trust is not certified under ISO 27001, indicating the absence of a formally recognized information security management framework.
Industry Classification of Evolve Bank & Trust
Evolve Bank & Trust operates primarily in the Financial Services industry.
Number of Employees at Evolve Bank & Trust
Evolve Bank & Trust employs approximately 546 people worldwide.
Subsidiaries Owned by Evolve Bank & Trust
Evolve Bank & Trust presently has no subsidiaries across any sectors.
Evolve Bank & Trust’s LinkedIn Followers
Evolve Bank & Trust’s official LinkedIn profile has approximately 10,182 followers.
NAICS Classification of Evolve Bank & Trust
Evolve Bank & Trust is classified under the NAICS code 52, which corresponds to Finance and Insurance.
Evolve Bank & Trust’s Presence on Crunchbase
No, Evolve Bank & Trust does not have a profile on Crunchbase.
Evolve Bank & Trust’s Presence on LinkedIn
Yes, Evolve Bank & Trust maintains an official LinkedIn profile, which is actively utilized for branding and talent engagement, which can be accessed here: https://www.linkedin.com/company/evolve-bank-&-trust.
Cybersecurity Incidents Involving Evolve Bank & Trust
As of November 28, 2025, Rankiteo reports that Evolve Bank & Trust has experienced 4 cybersecurity incidents.
Number of Peer and Competitor Companies
Evolve Bank & Trust has an estimated 29,546 peer or competitor companies worldwide.
What types of cybersecurity incidents have occurred at Evolve Bank & Trust ?
Incident Types: The types of cybersecurity incidents that have occurred include Breach and Ransomware.
Incident Details
Can you provide details on each incident ?
Title: Ransomware Attack and Data Breach at Evolve Bank and Trust
Description: Evolve Bank and Trust experienced a ransomware attack alongside a data breach, affecting its customers and fintech partners. The LockBit ransomware group claimed responsibility for the theft and publication of sensitive information on the dark web, disrupting banking operations and compromising client confidentiality.
Type: Ransomware
Threat Actor: LockBit ransomware group
Motivation: Financial gain and disruption
Title: Evolve Bank & Trust Data Breach
Description: Evolve Bank & Trust suffered a security breach causing the compromise of personal information. The breach was announced by the LockBit gang, which allegedly exfiltrated 33 TB of sensitive data from the Federal Reserve and leaked documents belonging to Evolve Bank. Certain customers' personal data, including names, addresses, SSNs or EINs, dates of birth, and contact details were involved. The breach affected fintech firms Wise and Affirm, their customers, and potentially undermined the security and trust in Evolve's banking services. Although the bank's core systems like debit cards and digital banking credentials were reportedly not affected, the incident highlights the vulnerability of financial data in the interconnected fintech ecosystem.
Type: Data Breach
Threat Actor: LockBit gang
Title: Evolve Bank & Trust Data Breach
Description: The Washington State Office of the Attorney General reported a data breach involving Evolve Bank & Trust on July 8, 2024. The breach, identified as a ransomware cyberattack, occurred between February 9, 2024, and May 31, 2024, potentially exposing the personal information of 275,716 individuals, including names, Social Security numbers, and financial information.
Date Detected: 2024-07-08
Date Publicly Disclosed: 2024-07-08
Type: Data Breach
Attack Vector: Ransomware
Title: Evolve Bank & Trust Data Breach
Description: The California Office of the Attorney General reported a data breach involving Evolve Bank & Trust on July 8, 2024. The breach was identified on May 29, 2024, when unauthorized activity was detected, leading to the potential exposure of customer information but no confirmed unauthorized access to funds.
Date Detected: May 29, 2024
Date Publicly Disclosed: July 8, 2024
Type: Data Breach
What are the most common types of attacks the company has faced ?
Common Attack Types: The most common types of attacks the company has faced is Breach.
Impact of the Incidents
What was the impact of each incident ?
Incident : Ransomware EVO449070624
Data Compromised: Sensitive information
Systems Affected: Banking operations
Operational Impact: Disruption of banking operations
Brand Reputation Impact: Undermined trust in cybersecurity measures
Incident : Data Breach EVO506070624
Data Compromised: Names, Addresses, Ssns or eins, Dates of birth, Contact details
Brand Reputation Impact: Potentially undermined the security and trust in Evolve's banking services
Incident : Data Breach EVO157072725
Data Compromised: Names, Social security numbers, Financial information
Incident : Data Breach EVO148072825
Data Compromised: Customer Information
What types of data are most commonly compromised in incidents ?
Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Sensitive information, Personal Information, Sensitive Data, , Names, Social Security Numbers, Financial Information, and Customer Information.
Which entities were affected by each incident ?
Incident : Ransomware EVO449070624
Entity Name: Evolve Bank and Trust
Entity Type: Financial Institution
Industry: Finance
Customers Affected: Customers and fintech partners
Incident : Data Breach EVO506070624
Entity Name: Evolve Bank & Trust
Entity Type: Bank
Industry: Finance
Incident : Data Breach EVO157072725
Entity Name: Evolve Bank & Trust
Entity Type: Bank
Industry: Financial Services
Customers Affected: 275716
Incident : Data Breach EVO148072825
Entity Name: Evolve Bank & Trust
Entity Type: Bank
Industry: Financial Services
Data Breach Information
What type of data was compromised in each breach ?
Incident : Ransomware EVO449070624
Type of Data Compromised: Sensitive information
Data Exfiltration: Yes
Incident : Data Breach EVO506070624
Type of Data Compromised: Personal information, Sensitive data
Sensitivity of Data: High
Data Exfiltration: 33 TB
Personally Identifiable Information: namesaddressesSSNs or EINsdates of birthcontact details
Incident : Data Breach EVO157072725
Type of Data Compromised: Names, Social security numbers, Financial information
Number of Records Exposed: 275716
Sensitivity of Data: High
Incident : Data Breach EVO148072825
Type of Data Compromised: Customer Information
Ransomware Information
Was ransomware involved in any of the incidents ?
References
Where can I find more information about each incident ?
Incident : Data Breach EVO157072725
Source: Washington State Office of the Attorney General
Date Accessed: 2024-07-08
Incident : Data Breach EVO148072825
Source: California Office of the Attorney General
Where can stakeholders find additional resources on cybersecurity best practices ?
Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: Washington State Office of the Attorney GeneralDate Accessed: 2024-07-08, and Source: California Office of the Attorney General.
Additional Questions
General Information
Who was the attacking group in the last incident ?
Last Attacking Group: The attacking group in the last incident were an LockBit ransomware group and LockBit gang.
Incident Details
What was the most recent incident detected ?
Most Recent Incident Detected: The most recent incident detected was on 2024-07-08.
What was the most recent incident publicly disclosed ?
Most Recent Incident Publicly Disclosed: The most recent incident publicly disclosed was on July 8, 2024.
Impact of the Incidents
What was the most significant data compromised in an incident ?
Most Significant Data Compromised: The most significant data compromised in an incident were Sensitive information, names, addresses, SSNs or EINs, dates of birth, contact details, , names, Social Security numbers, financial information, and Customer Information.
Data Breach Information
What was the most sensitive data compromised in a breach ?
Most Sensitive Data Compromised: The most sensitive data compromised in a breach were dates of birth, addresses, Social Security numbers, contact details, Sensitive information, financial information, SSNs or EINs, Customer Information and names.
What was the number of records exposed in the most significant breach ?
Number of Records Exposed in Most Significant Breach: The number of records exposed in the most significant breach was 991.0.
References
What is the most recent source of information about an incident ?
Most Recent Source: The most recent source of information about an incident are California Office of the Attorney General and Washington State Office of the Attorney General.
.png)
Latest Global CVEs (Not Company-Specific)
Description
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.16, 20.3.14, and 21.0.1, there is a XSRF token leakage via protocol-relative URLs in angular HTTP clients. The vulnerability is a Credential Leak by App Logic that leads to the unauthorized disclosure of the Cross-Site Request Forgery (XSRF) token to an attacker-controlled domain. Angular's HttpClient has a built-in XSRF protection mechanism that works by checking if a request URL starts with a protocol (http:// or https://) to determine if it is cross-origin. If the URL starts with protocol-relative URL (//), it is incorrectly treated as a same-origin request, and the XSRF token is automatically added to the X-XSRF-TOKEN header. This issue has been patched in versions 19.2.16, 20.3.14, and 21.0.1. A workaround for this issue involves avoiding using protocol-relative URLs (URLs starting with //) in HttpClient requests. All backend communication URLs should be hardcoded as relative paths (starting with a single /) or fully qualified, trusted absolute URLs.
Risk Information
cvss4
Base: 7.7
Severity: LOW
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
References
- https://github.com/angular/angular/commit/0276479e7d0e280e0f8d26fa567d3b7aa97a516f
- https://github.com/angular/angular/commit/05fe6686a97fa0bcd3cf157805b3612033f975bc
- https://github.com/angular/angular/commit/3240d856d942727372a705252f7c8c115394a41e
- https://github.com/angular/angular/releases/tag/19.2.16
- https://github.com/angular/angular/releases/tag/20.3.14
- https://github.com/angular/angular/releases/tag/21.0.1
- https://github.com/angular/angular/security/advisories/GHSA-58c5-g7wp-6w37
Description
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. An Uncontrolled Recursion vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft deep ASN.1 structures that trigger unbounded recursive parsing. This leads to a Denial-of-Service (DoS) via stack exhaustion when parsing untrusted DER inputs. This issue has been patched in version 1.3.2.
Risk Information
cvss4
Base: 8.7
Severity: LOW
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Description
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. An Integer Overflow vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft ASN.1 structures containing OIDs with oversized arcs. These arcs may be decoded as smaller, trusted OIDs due to 32-bit bitwise truncation, enabling the bypass of downstream OID-based security decisions. This issue has been patched in version 1.3.2.
Risk Information
cvss4
Base: 6.3
Severity: LOW
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Description
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Prior to versions 7.0.13 and 8.0.2, working with large buffers in Lua scripts can lead to a stack overflow. Users of Lua rules and output scripts may be affected when working with large buffers. This includes a rule passing a large buffer to a Lua script. This issue has been patched in versions 7.0.13 and 8.0.2. A workaround for this issue involves disabling Lua rules and output scripts, or making sure limits, such as stream.depth.reassembly and HTTP response body limits (response-body-limit), are set to less than half the stack size.
Risk Information
cvss3
Base: 7.5
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. In versions from 8.0.0 to before 8.0.2, a NULL dereference can occur when the entropy keyword is used in conjunction with base64_data. This issue has been patched in version 8.0.2. A workaround involves disabling rules that use entropy in conjunction with base64_data.
Risk Information
cvss3
Base: 7.5
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Access Data Using Our API
Get company history
curl -i -X GET 'https://api.rankiteo.com/underwriter-getcompany-history?linkedin_id=evolve-bank-&-trust' -H 'apikey: YOUR_API_KEY_HERE'
RapidWhat Do We Measure ?
Incident
Finding
Grade
Digital Assets
Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.
These are some of the factors we use to calculate the overall score:
Network Security
Identify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.
SBOM (Software Bill of Materials)
Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.
CMDB (Configuration Management Database)
Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.
Threat Intelligence
Leverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.
Rankiteo is a unified scoring and risk platform that analyzes billions of signals weekly to help organizations gain faster, more actionable insights into emerging threats. Empowering teams to outpace adversaries and reduce exposure.
