FinWise Bank, a Utah-based financial institution specializing in embedded banking, disclosed a data breach affecting 689,000 individuals due to insider wrongdoing. The compromised data included full names, dates of birth, Social Security numbers, and account numbers, stored unencrypted. The breach was discovered on May 31, 2024, but notifications to victims were delayed until July 2025, over a year later, violating regulatory timelines and exposing victims to prolonged identity theft risks. The incident led to six class-action lawsuits seeking over $5 million in damages, citing negligence, breach of contract, and failure to safeguard PII. Plaintiffs demanded lifetime credit monitoring (instead of the offered 12 months) and mandatory encryption of all future data. The breach impacted FinWise’s fintech partner, American First Finance, whose customer loan data was accessed. FinWise faces reputational harm, financial penalties, and operational scrutiny, though it claims potential losses are immaterial to its $14.7M quarterly net income.