US Bank is currently investigating claims made by the ransomware group LockBit regarding a data breach. The group has threatened to release allegedly stolen files on September 3 unless a ransom is paid.
Investigation Underway
Lee Henderson, Vice President of Public Affairs at US Bank, confirmed the bank’s awareness of these allegations. In an official statement, Henderson noted that the bank is conducting a thorough examination to determine if a cybersecurity incident has taken place.
Henderson further clarified via email to The Register, stating, “Currently, there is no evidence that our internal systems have been compromised or that unauthorized access to our network has occurred. Protecting the information of our clients and employees remains our highest priority.”
Details concerning any potential contact with LockBit, the nature of the compromised data, or the ransom amount remain undisclosed by the bank.
Ransomware Threats to Financial Institutions
LockBit added US Bank to its data leak site, imposing a 14-day deadline to fulfill its ransom demands. Specifics on the quantity or type of purportedly stolen data have not been disclosed by the group.
This incident underscores the persistent threat ransomware poses to financial entities. Such attacks often involve data theft, either preceding or independent of system encryption, compelling victims to pay ransoms under the threat of public data exposure.
Experts and authorities have consistently advised against paying ransoms, as it does not ensure the deletion of stolen data. During a 2024 operation that disrupted LockBit’s infrastructure, investigators discovered that the group retained victim data even after extortion payments.
Past Breaches and Ongoing Vigilance
In February 2024, international law enforcement dismantled some of LockBit’s operations, identifying Dmitry Yuryevich Khoroshev as a key figure. Despite this, the group continued its activities, introducing a new ransomware variant in 2025.
US Bank has previously faced data exposure incidents through third-party vendors. In a recent event involving Fidelity National Information Services, the bank notified 537 Massachusetts customers of a potential data compromise, although Social Security numbers and account balances were reportedly secure.
In 2022, another third-party vendor mishap exposed data of about 11,000 customers. This included sensitive information like Social Security numbers, account numbers, and outstanding balances. US Bank remains vigilant as the current investigation into LockBit’s claims continues.
To mitigate future incidents, it’s crucial for organizations to enhance their threat intelligence capabilities.
