Flagstar Bank admitted that the names and Social Security numbers of more than 1.5 million customers were leaked during a data breach that started on December 3.
In letters sent out to victims on Friday, the bank said hackers broke into its systems on December 3 and December 4 last year, but they only realized sensitive customer information was accessed on June 2.
“Upon learning of the incident, we promptly activated our incident response plan, engaged external cybersecurity professionals experienced in handling these types of incidents, and reported the matter to federal law enforcement,” the bank said.
Documents filed with the Attorney General of Maine said 1,547,169 people were affected by the breach.
Flagstar Bank said it is offering victims two years of free identity monitoring through Kroll. The services include credit monitoring, fraud consultation and identity theft restoration.
Flagstar Bank, which is based in Michigan, did not respond to requests for comment about why it took them six months to notify such a large number of customers.
The bank was previously hacked by the Clop ransomware group through the widely exploited zero-day vulnerability in Accellion file-sharing servers.
Several organizations were attacked alongside Flagstar Bank, including Australian Securities and Investments Commission (ASIC), law firm Allens, the University of Colorado, the Washington State Auditor Office, the QIMR Berghofer Medical Research Institute, Singapore telco Singtel, security firm Qualys, airplane maker Bombardier, and US retail store chain Kroger.
The ransomware group ended up publishing some of the data it stole from Flagstar Bank after attempting to extort the bank.
The post Flagstar Bank breach leaks Social Security numbers of more than 1.5 million people appeared first on The Record by Recorded Future.
Article Link: Flagstar Bank breach leaks Social Security numbers of more than 1.5 million people - The Record by Recorded Future