U.S. Bancorp Attributes Data Theft Claims to Third-Party Contractor Breach U.S. Bancorp, the seventh-largest bank in the U.S., has confirmed that recent data theft claims by the LockBit ransomware gang stem from a breach involving a contractor for a third-party vendor not its own systems. A spokesperson stated that an investigation found no evidence of compromise to the bank’s networks, data repositories, or internal systems, though the incident appears linked to a "fourth-party event" outside its environment. The claims surfaced on Thursday when LockBit added U.S. Bancorp to its victim list, threatening to leak stolen data within two weeks. The bank initially denied any impact on its operations and later reiterated that no unauthorized access to its systems had been detected. Neither U.S. Bancorp nor LockBit disclosed the identity of the affected third or fourth party, nor did the ransomware group provide proof of the stolen data. LockBit, once one of the most prolific ransomware operations, was dismantled in a 2024 law enforcement takedown but has since attempted to regroup. Between 2022 and 2024, the group extorted an estimated $252.4 million from 353 victims, according to the U.S. Treasury Department. Despite its efforts to revive, the gang has faced operational disruptions amid heightened scrutiny. This incident follows another ransomware listing earlier in the week, targeting Cameroon’s Crédit Communautaire d'Afrique Bank, which reported operational issues prior to the attack. U.S. Bancorp has notified law enforcement and continues to monitor the situation.

The California Office of the Attorney General reported that U.S. Bank experienced a data breach on September 23, 2022, affecting customer personal information, including names, addresses, social security numbers, dates of birth, and account details. The breach was reported on October 27, 2022, and it involved inadvertent sharing of a file by a vendor.

The Maine Attorney General's Office reported that U.S. Bank, N.A. experienced a credential stuffing attack on March 31, 2021, affecting a total of 333 individuals, including 2 residents of Maine. The breach was discovered on the same date, and consumers were notified by telephone on April 2, 2021.

On February 3, 2021, the California Office of the Attorney General reported a data breach involving U.S. Bank, N.A., which occurred on July 30, 2020. The breach involved the physical theft of a computer server containing personally identifiable information, including names and Social Security numbers of affected individuals. The number of individuals affected is currently unknown.