US Bank investigates LockBit's claims as ransomware crims set pay-or-leak deadline
Follow the money
security US Bank says that it's investigating ransomware crew LockBit’s claims that it breached the financial institution and stole data, which the crims threaten to leak on September 3 unless the bank pays an extortion demand.
"We have investigated this matter and the available evidence indicates that the claim regarding a potential cyber incident is related to a fourth party event that occurred outside of our environment. At this time, there is no evidence that our systems, networks or data repositories were compromised," Lee Henderson, US Bank VP of public affairs, said in an emailed statement to The Register.
If the extortionists’ claims are true, and even if the bank pays the ransom demand, there’s still no guarantee that the digital thieves will delete the stolen files. When cops took down an earlier iteration of LockBit in 2024, they found evidence that the crooks retained victim data - even after the victims paid the extortion demands.
“We have provided relevant information to law enforcement and continue to support their investigation," Henderson continued. "The security and privacy of our customers’ information is our highest priority. We will continue to provide updates as warranted.”
LockBit added the bank to its leak site late Wednesday night, and gave the bank 14 days to pay a ransom demand or else see its data dumped online. The post doesn’t say how many files the crew allegedly stole, or what they contained.
In February 2024, international cops seized servers, domain infrastructure, and decryption keys in an effort to dismantle the notorious ransomware group, and in May 2024, they outed LockBitSupp's true identity - although Dmitry Yuryevich Khoroshev, a Russian national, remains at large.
In September 2025, however, LockBit reemerged with its new LockBit 5.0 ransomware variant.
LockBit’s latest claims follow previous third-party breaches affecting US Bank customers’ data, and at least one law firm says that it’s considering a class-action lawsuit against US Bank National Association, the primary banking subsidiary of US Bancorp, on behalf of a small group of customers whose credit card information may have been exposed in a third-party security snafu that reached the bank through its vendor, Fidelity National Information Services.
US Bank reportedly found out about the third-party incident on May 7, and in June, began notifying 537 customers, all Massachusetts residents, that their names, mailing addresses, and credit card numbers may have been stolen by the digital crooks.
- Ransomware crook poses as recovery firm to steal payments from fellow extortionists
- US bank places trust in ransomware crew that promised to delete its data
- Greedy ransomware crews return for seconds after victims cough up first extortion payments
- 'Dumbass' criminal breaks the 'first rule of ransomware club'
Customers’ Social Security numbers, online banking credentials, and account balances reportedly weren’t accessed.
A much larger incident affecting around 11,000 customers occurred in 2022, after a different vendor “accidentally shared” a file containing personal information associated with closed US Bank credit card accounts, including names, addresses, Social Security numbers, dates of birth, closed account numbers, and outstanding balances.®
Updated on Aug 21 with a new statement from US Bank.