The bank says a review points to an outside vendor incident rather than a breach of its own systems, as the ransomware gang sets a deadline to leak alleged stolen files.
US Bank is reviewing claims from the ransomware group LockBit that the gang broke into the bank’s systems and stole data, after the criminals threatened to publish the files on September 3 unless an extortion payment is made.
Lee Henderson, vice president of public affairs at US Bank, said in an emailed statement that the bank looked into the matter and found that available evidence points to a fourth-party event that took place outside its own environment. Henderson said there is currently no evidence that the bank’s systems, networks or data repositories were compromised.
Henderson added that the bank has shared relevant information with law enforcement and continues to support the ongoing investigation. He said protecting customer information and privacy remains the bank’s top priority and that further updates will follow as warranted.
LockBit listed US Bank on its leak site late Wednesday night, giving the bank 14 days to meet its ransom demand before threatening to release the stolen files. The posting did not specify how many files were allegedly taken or what information they contained.
Even a ransom payment would not guarantee deletion of the files if the extortionists’ claims prove accurate. When law enforcement dismantled an earlier version of LockBit in 2024, investigators discovered that the group had kept victim data even after those victims had paid.
The LockBit operation has a history of law enforcement action and resurgence. In February 2024, international police seized the group’s servers, domain infrastructure and decryption keys in a bid to take down the ransomware operation. That May, authorities identified the person behind the LockBitSupp persona as Dmitry Yuryevich Khoroshev, a Russian national who remains at large. The group returned in September 2025 with a new variant known as LockBit 5.0.
The LockBit claim adds to a series of incidents involving third parties that have affected US Bank customer data. At least one law firm is weighing a class-action lawsuit against US Bank National Association, the primary banking subsidiary of US Bancorp, on behalf of a small group of customers whose credit card information may have been exposed through a security incident at vendor Fidelity National Information Services.
US Bank reportedly learned of that third-party incident on May 7 and began notifying affected customers in June. The notifications went to 537 customers, all Massachusetts residents, informing them that their names, mailing addresses and credit card numbers may have been stolen. Social Security numbers, online banking credentials and account balances reportedly were not accessed.
A separate and larger incident occurred in 2022, when a different vendor accidentally shared a file containing personal information tied to closed US Bank credit card accounts. That exposure affected roughly 11,000 customers and included names, addresses, Social Security numbers, dates of birth, closed account numbers and outstanding balances.
