security
US Bank investigates LockBit's claims as ransomware crims set pay-or-leak deadline
Follow the money
Jessica Lyons
JessicaLyonsCybersecurity Editor
Published
thu 20 Aug 2026 // 18:30 UTC
US Bank says that it's investigating ransomware crew LockBit’s claims that it breached the financial institution and stole data, which the crims threaten to leak on September 3 unless the bank pays an extortion demand.
"We have investigated this matter and the available evidence indicates that the claim regarding a potential cyber incident is related to a fourth party event that occurred outside of our environment. At this time, there is no evidence that our systems, networks or data repositories were compromised," Lee Henderson, US Bank VP of public affairs, said in an emailed statement toThe Register.
If the extortionists’ claims are true, and even if the bank pays the ransom demand, there’s still no guarantee that the digital thieves will delete the stolen files. When cops took down an earlier iteration of LockBit in 2024, they found evidence that thecrooks retained victim data- even after the victims paid the extortion demands.
REG AD
“We have provided relevant information to law enforcement and continue to support their investigation," Henderson continued. "The security and privacy of our customers’ information is our highest priority. We will continue to provide updates as warranted.”
REG AD
LockBitadded the bankto its leak site late Wednesday night, and gave the bank 14 days to pay a ransom demand or else see its data dumped online. The post doesn’t say how many files the crew allegedly stole, or what they contained.
In February 2024, international copsseized servers, domain infrastructure, and decryption keys in an effort to dismantle the notorious ransomware group, and in May 2024, theyouted LockBitSupp's true identity- although Dmitry Yuryevich Khoroshev, a Russian national, remains at large.
In September 2025, however, LockBit reemerged with its newLockBit 5.0 ransomware variant.
LockBit’s latest claims follow previous third-party breaches affecting US Bank customers’ data, and at least one law firm says that it’sconsidering a class-action lawsuitagainst US Bank National Association, the primary banking subsidiary of US Bancorp, on behalf of a small group of customers whose credit card information may have been exposed in a third-party security snafu that reached the bank through its vendor, Fidelity National Information Services.
US Bank reportedly found out about the third-party incident on May 7, and in June, began notifying 537 customers, all Massachusetts residents, that their names, mailing addresses, and credit card numbers may have been stolen by the digital crooks.
MORE CONTEXT
Ransomware crook poses as recovery firm to steal payments from fellow extortionists
US bank places trust in ransomware crew that promised to delete its data
Greedy ransomware crews return for seconds after victims cough up first extortion payments
'Dumbass' criminal breaks the 'first rule of ransomware club'
Customers’ Social Security numbers, online banking credentials, and account balances reportedly weren’t accessed.
A much larger incident affecting around11,000 customersoccurred in 2022, after a different vendor“accidentally shared” a filecontaining personal information associated with closed US Bank credit card accounts, including names, addresses, Social Security numbers, dates of birth, closed account numbers, and outstanding balances.®
Updated on Aug 21with a new statement from US Bank.
ransomwarelockbitus banksecurity
