U.S. Bank says breach claims related to fourth

U.S. Bancorp said recent claims of data theft by a ransomware gang are related to a breach involving a contractor for a third-party, and do not impact its own systems or network. 

A spokesperson told Recorded Future News that U.S. Bancorp has investigated the claims and traced it back to “a potential cyber incident…related to a fourth party event that occurred outside” of their environment. 

“At this time, there is no evidence that our systems, networks or data repositories were compromised,” the spokesperson said. “We have provided relevant information to law enforcement and continue to support their investigation.”

The claims emerged on Thursday morning, when the LockBit ransomware gang added U.S. Bancorp to its list of victims and threatened to leak data in two weeks. 

U.S. Bancorp initially told Recorded Future News that there was no indication the bank’s systems were impacted and no evidence of unauthorized access to their network. 

The company declined to name the third and fourth party at the source of the breach. U.S. Bancorp said it will continue to monitor the claims and remain vigilant about data exposure. 

U.S. Bancorp is the 7th largest bank in the United States and reported $7.7 billion last quarter.

LockBit did not provide any samples of the stolen information to legitimize their claims. Past leaks of the ransomware source code have allowed an array of other cybercriminals to use LockBit in attacks, even on organizations in Russia — where its leaders are allegedly based. 

The ransomware gang was one of the most active and destructive groups for years before law enforcement agencies in multiple countries coordinated on a much-heralded takedown in 2024.

In December, the U.S. Treasury Department said LockBit earned $252.4 million in ransoms through 353 successful attacks from 2022 to 2024.

The group has repeatedly tried to revive its operation but has faced operational issues and other problems tied to increased law enforcement action. 

U.S. Bancorp is the second bank added to a ransomware leak site this week after Cameroon’s Crédit Communautaire d'Afrique Bank was listed by another group on Friday. The bank reported operational issues two weeks ago.