Short answer: LockBit claimed in June 2024 that it had breached the U.S. Federal Reserve and stolen about 33 terabytes of data. Publicly available evidence and Evolve Bank & Trust’s own notices instead identified Evolve as the source of the leaked information. The Federal Reserve’s connection was a separate regulatory enforcement action against Evolve—not evidence that the central bank had been hacked.
What LockBit claimed
In late June 2024, the LockBit ransomware group claimed on its leak site that it had compromised the Federal Reserve. The group reportedly demanded a ransom and threatened to publish roughly 33 terabytes of banking data.
As an Amazon Associate I earn from qualifying purchases.
The claim attracted attention because the Federal Reserve is a high-profile U.S. financial institution and because LockBit had recently been disrupted by an international law-enforcement operation. But a ransomware group’s post is an allegation, not independent confirmation. Contemporary reporting and subsequent disclosures pointed to a different organization.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →The leaked data pointed to Evolve Bank & Trust
The released material and references pointed to Evolve Bank & Trust, an Arkansas-based bank that provides banking services to consumers, businesses and fintech partners. Evolve later said LockBit had “mistakenly attributed” the stolen data to the Federal Reserve and confirmed that it had suffered a ransomware incident.
#1 Best Overall
That supports Evolve as the source of the publicly discussed leaked data. It does not independently validate every file LockBit claimed to possess, nor does it establish that the Federal Reserve was breached. The safer conclusion is that LockBit’s Federal Reserve claim was misleading or mistaken.
What happened at Evolve
According to Evolve’s incident FAQ and its substitute breach notice, the sequence was:
- Evolve noticed in late May 2024 that some systems were not working properly. The problem initially appeared to be a hardware failure.
- The bank later determined that unauthorized activity had occurred.
- Evolve said an employee appeared to have clicked a malicious internet link, providing the apparent initial access route. That statement does not necessarily describe the entire attack chain.
- Attackers accessed and downloaded information from databases and a file share during periods in February and May 2024.
- Some systems or data were encrypted, but Evolve said backups limited operational impact and data loss.
- The bank said it stopped the attack and observed no new unauthorized activity after May 31, 2024.
- Evolve said it refused to pay the ransom. LockBit subsequently published the downloaded data.
Evolve reported the incident to law enforcement and said it engaged outside specialists, reset passwords globally, rebuilt Active Directory, updated firewall and monitoring rules, deployed endpoint-detection-and-response tools, and strengthened its incident-response procedures.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →What information may have been exposed?
Evolve said affected files could contain different types of information for different people. Potentially exposed data included:
- Names, dates of birth and contact information
- Social Security numbers
- Evolve account numbers
- ACH transaction details, including financial account numbers, routing numbers and names of payors and payees
- Debit-card numbers for a small portion of affected individuals
- Information connected to personal, mortgage, trust and small-business banking customers
- Information belonging to customers of Evolve’s open-banking and fintech partners
- Certain employee information
This should not be summarized as a single exposure of “banking credentials.” Evolve’s early public statement said retail customers’ online-banking credentials, digital-banking credentials and debit cards did not appear to be affected. Its later substitute notice said debit-card numbers were present in files for a small portion of affected individuals. The later notice reflected a more developed investigation.
Similarly, Evolve said there was no evidence that criminals accessed customer funds. That is not the same as saying there was no risk of identity theft, fraudulent ACH activity or attempted account takeover.
How many people were affected?
Initial notices said the investigation was continuing. Evolve began sending individual notifications on July 8, 2024, according to its incident page.
A later filing reported approximately 7.6 million affected people, according to TechCrunch. That population included Evolve customers and customers of fintech and open-banking partners. The figure should not be interpreted to mean that all 7.6 million people had the same information exposed. Some people may have had only limited contact or account information involved, and some may never have heard of Evolve because they used a fintech brand instead.
Why was the Federal Reserve part of the story?
The Federal Reserve had a documented but separate connection to Evolve. On June 14, 2024—shortly before LockBit’s claim—the Federal Reserve announced an enforcement action against Evolve Bancorp and Evolve Bank & Trust.
The action cited deficiencies involving anti-money-laundering controls, risk management, consumer-compliance programs and oversight of fintech partnerships. It required Evolve to improve its controls and monitoring. The Federal Reserve’s action did not say that the Federal Reserve itself had been hacked, and it did not establish that those regulatory deficiencies caused the ransomware incident.
The timing likely contributed to the confusion: a criminal group named the Federal Reserve while the leaked data was associated with a bank that had just faced a Federal Reserve enforcement action. That is a reasonable explanation for the headlines, not a finding that the two events were causally connected.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsWhy the breach mattered to fintech customers
Evolve’s role as a banking partner meant the incident extended beyond people who recognized the Evolve name. Banking-as-a-service arrangements can place sensitive records at a sponsor bank even when a customer primarily interacts with a fintech app or brand.
Best Value
The incident illustrates several risks:
- Third-party concentration: One bank may hold information connected to many fintech products.
- Identity and access risk: A malicious link can become an entry point into systems containing highly sensitive records.
- Data-exfiltration risk: Restoring encrypted systems does not undo the copying of databases or file shares.
- Customer confusion: Individuals may not know which bank stores their information or who is responsible for notification.
- Oversight obligations: Sponsor banks and fintech partners need clear controls for access, monitoring, compliance and incident response.
What potentially affected people should do
- Verify any notice. Use contact details from Evolve’s official incident page or your fintech provider—not links in an unsolicited email or text.
- Use the offered protection. Evolve said notified individuals could receive two years of credit monitoring and identity-theft protection. Start with that complimentary benefit before paying for a separate service.
- Consider a credit freeze. A freeze with each major U.S. credit bureau can help prevent new-credit accounts from being opened in your name. It is free and can be lifted when needed.
- Review activity. Check bank, fintech and ACH transactions, unfamiliar account-opening inquiries and account alerts. Report suspicious activity promptly to the relevant institution.
- Secure accounts. Change reused passwords, use unique credentials and enable multifactor authentication on financial and email accounts.
- Expect follow-up scams. Do not provide Social Security numbers, passwords, one-time codes or payments to someone who contacts you claiming to provide breach assistance.
- Report identity theft. Use the Federal Trade Commission’s identity-theft resources and contact law enforcement when appropriate.
Do not automatically close every account. The exposed information varied, and Evolve said it had found no evidence that customer funds were accessed. Account-specific action should depend on the notification you received and any suspicious activity you observe.
Lessons for banks and fintech partners
Organizations handling financial data should evaluate controls that address both initial access and the consequences of data theft:
- Phishing-resistant multifactor authentication for privileged and high-risk users
- Endpoint detection and response with centralized alerting
- Network segmentation and protected administrative paths
- Least-privilege access and a current inventory of partner connections
- Active Directory hardening and recovery testing
- Immutable, offline or otherwise ransomware-resilient backups
- Logging that detects unusual database queries and bulk downloads
- Data minimization and retention limits for sensitive records
- Clear breach-notification responsibilities between sponsor banks and fintechs
- Tabletop exercises covering ransomware, exfiltration, partner disruption and public misattribution
Security products such as EDR, managed detection and response, privileged-access management and incident-response services can support these goals, but none replaces tested backups, strong identity controls, segmentation and partner oversight.
Recommended Free Tools
Bottom line
LockBit claimed it had breached the Federal Reserve, but the public evidence and Evolve’s own notices identified Evolve Bank & Trust as the source of the leaked data. The incident exposed information associated with Evolve and its fintech partners, with a later filing reporting approximately 7.6 million affected people. The Federal Reserve was involved as Evolve’s regulator—not as the confirmed victim of the ransomware attack.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
