Bank of America Warns Customers of Data Breach

Bank of America has alerted its customers to a data breach after one of its service providers, Infosys McCamish Systems (IMS), was hacked last year.

The breach exposed customers’ personally identifiable information (PII), including names, addresses, Social Security numbers, dates of birth, and financial details like account and credit card numbers. The Attorney General of Texas received these details.

Bank of America serves around 69 million clients across more than 3,800 retail financial centers and 15,000 ATMs in the United States, its territories, and over 35 countries.

When contacted for comment, a Bank of America spokesperson declined to provide additional details and directed inquiries to Infosys McCamish.

While the exact number of affected customers has not been disclosed by Bank of America, a breach notification letter filed with the Attorney General of Maine revealed that 57,028 people were directly impacted.

IMS experienced a cybersecurity event around Nov. 3, 2023, resulting in the unauthorized access of IMS systems and the non-availability of certain applications. On Nov. 24, 2023, IMS informed Bank of America that data related to deferred compensation plans may have been compromised, although Bank of America’s systems remained unaffected.

LockBit ransomware gang claimed responsibility for the IMS attack, which led to the encryption of over 2,000 systems. LockBit has targeted numerous high-profile organizations and is known for its ransomware-as-a-service (RaaS) operation.

Infosys, IMS’ parent company, has not responded to requests for confirmation of LockBit’s claims or further information about the breach.

In May 2023, Bank of America customers’ information handled by Ernst & Young was exposed after the Clop cybercrime gang breached the MOVEit Transfer platform. Ernst & Young stated that Bank of America’s systems and servers were not affected, but the breach impacted 30,210 individuals, compromising their financial account information, credit card details, Social Security numbers, and other government-issued identification numbers.

The breaches underscore the importance of robust cybersecurity measures and vigilance in safeguarding personal information from evolving threats.