U.S. Bancorp: U.S. Bank says breach claims related to fourth-party incident

U.S. Bancorp Attributes Data Theft Claims to Third-Party Contractor Breach

U.S. Bancorp, the seventh-largest bank in the U.S., has confirmed that recent data theft claims by the LockBit ransomware gang stem from a breach involving a contractor for a third-party vendor not its own systems. A spokesperson stated that an investigation found no evidence of compromise to the bank’s networks, data repositories, or internal systems, though the incident appears linked to a "fourth-party event" outside its environment.

The claims surfaced on Thursday when LockBit added U.S. Bancorp to its victim list, threatening to leak stolen data within two weeks. The bank initially denied any impact on its operations and later reiterated that no unauthorized access to its systems had been detected. Neither U.S. Bancorp nor LockBit disclosed the identity of the affected third or fourth party, nor did the ransomware group provide proof of the stolen data.

LockBit, once one of the most prolific ransomware operations, was dismantled in a 2024 law enforcement takedown but has since attempted to regroup. Between 2022 and 2024, the group extorted an estimated $252.4 million from 353 victims, according to the U.S. Treasury Department. Despite its efforts to revive, the gang has faced operational disruptions amid heightened scrutiny.

This incident follows another ransomware listing earlier in the week, targeting Cameroon’s Crédit Communautaire d'Afrique Bank, which reported operational issues prior to the attack. U.S. Bancorp has notified law enforcement and continues to monitor the situation.

Source: https://therecord.media/us-bank-says-breach-claims-related-to-fourth-party-incident

U.S. Bancorp TPRM report: https://www.rankiteo.com/company/us-bank

"id": "us-1787336653",
"linkid": "us-bank",
"type": "Ransomware",
"date": "8/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'industry': 'Financial Services',
                        'location': 'United States',
                        'name': 'U.S. Bancorp',
                        'size': 'Seventh-largest bank in the U.S.',
                        'type': 'Bank'}],
 'attack_vector': 'Third-party contractor breach',
 'data_breach': {'data_exfiltration': True},
 'description': 'U.S. Bancorp confirmed that recent data theft claims by the '
                'LockBit ransomware gang stem from a breach involving a '
                'contractor for a third-party vendor, not its own systems. The '
                'bank stated no evidence of compromise to its networks, data '
                'repositories, or internal systems was found, though the '
                "incident appears linked to a 'fourth-party event' outside its "
                'environment.',
 'impact': {'data_compromised': True,
            'operational_impact': "No impact on bank's operations"},
 'initial_access_broker': {'entry_point': 'Third-party contractor'},
 'investigation_status': 'Ongoing',
 'motivation': 'Extortion',
 'post_incident_analysis': {'root_causes': "Fourth-party event outside bank's "
                                           'environment'},
 'ransomware': {'data_exfiltration': True, 'ransomware_strain': 'LockBit'},
 'references': [{'source': 'U.S. Bancorp spokesperson'},
                {'source': 'LockBit victim list'},
                {'source': 'U.S. Treasury Department'}],
 'response': {'communication_strategy': 'Public denial of impact on operations',
              'enhanced_monitoring': True,
              'law_enforcement_notified': True},
 'threat_actor': 'LockBit ransomware gang',
 'title': 'U.S. Bancorp Data Theft Claims Attributed to Third-Party Contractor '
          'Breach',
 'type': 'Data Theft'}