Flagstar Bank is notifying customers that a data breach targeting a third-party vendor has resulted in the exposure of personal customer information. Flagstar uses the vendor in question, Fiserv, for transaction processing and mobile banking services. The notice sent out on Friday states that Fiserv is one of the many organisations impacted by the headlining mass MOVEit file transfer hack.
Prior to its 2022 acquisition by New York Community Bank, Flagstar previously had assets of over $31 billion as one of the largest banks in the United States. The bank is now contacting over 800,000 customers to alert them of the breach impacting the third-party vendor, Fiserv. This is the third breach Flagstar has suffered since 2021.
“The incident involved vulnerabilities discovered in MOVEit Transfer, a file transfer software used by our vendor to support services it provides to Flagstar and its related institutions,” reads the consumer notification letter.
According to the notice, Fiserv was a victim of the MOVEit breach between May 27-31st of 2023, which was before the public disclosure of the MFT vulnerability. As with the thousands of other organisations impacted in this breach, Fiserv’s systems were accessed by unauthorized actors, and files relating to Flagstar Bank and its customers was obtained.
“The MOVEit Transfer security flaw is the gift that keeps on giving for hackers. This time around, it looks like the bad guys were able to steal customer and employee information, including names, addresses, phone numbers, tax records, and SSNs,” Chris Hauk, Consumer Privacy Champion at Pixel Privacy, says. “Customers of this bank (along with any customers of organisations hit by MOVEit Transfer hacks) will want to keep a close eye on all of their accounts, take advantage of the inevitable free credit monitoring, and they should stay alert for possible phishing attempts.”
James McQuiggan, Security Awareness Advocate at KnowBe4, adds that, “This narrative of the MOVE-IT data breach is being replayed across boardrooms as the aftershocks of third-party vendor vulnerabilities continue to haunt organizations. This incident highlights the imperative for an enhanced cybersecurity framework within organizations and extending into the broader networks of third-party arrangements.”
“Rigid due diligence, robust cybersecurity policies, and real-time monitoring of third-party vendors are no longer a good idea but are necessary programs to reduce the risk of these cyber breaches. This attack demonstrates that an organization’s security is only as strong as its third or fourth party’s weakest security program.”
Andrew Bolster, senior manager of research and development at the Synopsys Software Integrity Group, said “This is just the latest in a long line of data breaches related to the MOVEit platform, with estimated costs topping $10bn affecting up to 67m customers; but what’s most concerning about the nature of these attacks is the suggestion that the CL0P ‘Threat Actor’ has been sitting on this exploit since at least 2021.
“This has concerning implications for both consumers and agencies delegating their secure data handling to third parties like MOVEit; Cl0p were able to methodically exfiltrate and later encrypt corporate data with impunity, rather than a dramatic ‘snatch and grab’, meaning they were able to step through both a ‘pay us to decrypt your data’ ransomware phase, as well as a subsequent ‘pay us or we’ll make your data public’ phase.
“Security leaders will have to review their incident response strategies and institute much more stringent certification and review of third party tools in future.”
The first breach targeting Flagstar was also a result of a file transfer hack. This was in March 2021 when the Clop ransomware gang was able to steal PII like SSNs, tax records, addresses, and more from the bank.
The second out of the three breaches occurred in June 2022 and impacted over 1.5 million American customers.
Fortunately, it seems like Flagstar and Fiserv are taking this third breach seriously. An investigation was launched immediately in response. Flagstar’s notice stated, “To help prevent something like this happening again our vendor has, through their service provider, remediated all technical vulnerabilities and patched systems in accordance with the MOVEit software provider’s guidelines.”
Additionally, Flagstar bank has arranged for customers affected by this breach to receive a complimentary free two-year identity monitoring service through Kroll.
“Financial institutions and organizations across industries often rely on third-party providers for critical services, but this dependence comes with inherent risks. It is crucial for organizations to assess the security posture of their vendors, conduct due diligence, and establish stringent contractual obligations regarding data protection,” Erfan Shadabi, cybersecurity expert with data security specialists comforte AG, says.
“At the same time, financial institutions should invest in data-centric security. Data-centric security is a proactive approach that places the focus on securing the data itself rather than just the perimeter or access points. It recognizes that data is a valuable asset and aims to protect it wherever it resides, whether within the organization’s network or when shared with third parties. Such an approach ensures that even if a third-party vendor experiences a security breach, the stolen data remains incomprehensible and useless to malicious actors.”
Finally, Paul Bischoff, Consumer Privacy Advocate at Comparitech says, “Flagstar Bank customers should monitor their credit reports for suspicious activity as well as their accounts for unfamiliar transactions. Take advantage of the free credit monitoring and place a fraud alert on your credit report. The breach of Social Security numbers puts all affected customers at risk of identity theft. When it comes time to file taxes, be sure to do so as early as possible to avoid someone committing tax fraud in your name. I fear we haven’t seen the last of MOVEit-related breaches like this one.”
