The Evolve Bank and Trust class action lawsuit is one of the most significant banking data breach cases of the decade, affecting an estimated 7.6 million people across the United States. If your personal or financial data was exposed through Evolve Bank or any FinTech company that used Evolve as its banking partner, you may be entitled to compensation.
This is not a small, obscure case. The breach reached people who never directly opened an account with Evolve Bank. That is what makes it different.
In this guide, you will learn exactly what happened, who qualifies, how much you might receive, and what steps to take before the 2026 filing deadlines close.
One figure stands out from the start: the LockBit ransomware group stole data on over 7.6 million individuals in a single attack on a bank that was quietly powering some of America’s most popular financial apps.
Evolve Bank and Trust Class Action Lawsuit: What It Is and Why It Matters
The Evolve Bank and Trust class action lawsuit is a legal action filed by affected consumers against Evolve Bank and Trust for failing to protect sensitive personal and financial data from a ransomware attack.
Filed in federal court following the June 2024 breach, the lawsuit accuses Evolve of negligence, failure to maintain adequate cybersecurity, and violations of federal consumer protection laws including the Gramm-Leach-Bliley Act.
The case is significant because Evolve was not just a traditional retail bank. It served as the banking backbone for dozens of FinTech companies, meaning millions of people who never heard of Evolve Bank had their data stored there.
| Case Detail | Information |
|---|---|
| Defendant | Evolve Bank and Trust |
| Case Type | Class Action Lawsuit |
| Breach Date | Confirmed June 2024 |
| Number of Victims | Approximately 7.6 million |
| Court | U.S. District Court |
| Laws Cited | GLBA, FCRA, state consumer protection laws |
| Status as of 2026 | Active litigation |
The lawsuit seeks damages for identity theft exposure, financial harm, and the ongoing burden victims face monitoring their credit and personal information.
This is a case where the bank’s business model, partnering with dozens of apps and companies, turned a single security failure into a catastrophe for millions.
Evolve Bank Data Breach Lawsuit: The Core Legal Claims
The evolve bank data breach lawsuit centers on several specific legal failures that attorneys argue Evolve Bank committed before, during, and after the attack.
The core claims are not vague. They are precise, and they carry real legal weight.
Primary legal claims in the lawsuit:
- Negligence in maintaining cybersecurity infrastructure
- Failure to encrypt sensitive consumer data properly
- Violation of the Gramm-Leach-Bliley Act (GLBA), which requires financial institutions to protect customer information
- Failure to timely notify affected customers after the breach was discovered
- Breach of fiduciary duty to customers and FinTech partner customers
The lawsuit also points to the fact that the Federal Reserve and Arkansas State Banking Department had already identified compliance weaknesses at Evolve Bank through a separate enforcement action, suggesting the bank had warning signs it ignored.
| Legal Claim | Legal Basis |
|---|---|
| Negligence | Common law duty of care |
| Data Protection Failure | Gramm-Leach-Bliley Act (GLBA) |
| Late Notification | State breach notification laws |
| Fiduciary Breach | Bank-customer trust relationship |
| Consumer Protection | State UDAP statutes |
Plaintiffs argue that Evolve’s rapid expansion into the FinTech space outpaced its ability to secure the data it was collecting and storing for millions of people.
Key Takeaway: The Evolve Bank data breach lawsuit rests on provable legal theories tied to both federal law and state consumer protection statutes, giving plaintiffs a solid foundation for recovery.
What Happened in the Evolve Bank Hack
The Evolve Bank hack began with a phishing attack that gave the LockBit ransomware group access to Evolve’s internal systems in early 2024.
By the time the attack was fully contained, the hackers had extracted a massive dataset and published it on the dark web.
Here is the straightforward version of what happened:
Timeline of Events:
- Early 2024: LockBit infiltrates Evolve Bank’s systems via phishing
- May 2024: Hackers demand ransom; Evolve refuses to pay
- June 2024: LockBit publishes stolen Evolve data on the dark web
- Late June 2024: Evolve Bank publicly confirms the breach
- July 2024: Federal Reserve issues enforcement action against Evolve
- July through August 2024: Multiple class action complaints filed
- 2025: Cases consolidated in federal court; discovery phase begins
- 2026: Active litigation continues; settlement negotiations ongoing
Think of it like a landlord who rents space to 50 businesses but stores all their customer files in a single unlocked cabinet. When a burglar breaks in, every tenant’s customers are exposed, even the ones who never dealt with the landlord directly.
Evolve was that landlord. Except the cabinet held social security numbers, account numbers, and transaction histories for millions of people.
Evolve Bank LockBit Ransomware Attack Explained
The LockBit ransomware group is one of the most prolific and destructive cybercriminal organizations in the world, responsible for attacks on banks, hospitals, and government agencies across dozens of countries.
In the Evolve Bank attack, LockBit used a method called double extortion. They encrypted Evolve’s data and threatened to publish it publicly if the ransom was not paid.
Evolve chose not to pay. LockBit published the data.
How LockBit’s Attack on Evolve Worked:
- Stage 1: Initial access gained through a phishing email clicked by an Evolve employee
- Stage 2: LockBit moved laterally through Evolve’s internal network over weeks
- Stage 3: Data exfiltrated before encryption was deployed
- Stage 4: Ransom demand issued with a deadline
- Stage 5: Evolve declined to pay; LockBit released data publicly
The Department of Justice had previously indicted several LockBit members, but the group continued operating through new infrastructure.
| Attack Characteristic | Detail |
|---|---|
| Attack Method | Phishing + lateral movement |
| Ransomware Type | LockBit 3.0 |
| Extortion Style | Double extortion (encrypt + publish) |
| Ransom Paid | No |
| Data Published | Yes, on dark web |
| Estimated Records Exposed | 7.6 million+ |
The publication of data on the dark web is what turns a ransomware attack into a long-term identity theft risk for every person whose information was included.
What Data Was Stolen in the Evolve Bank Breach
The Evolve Bank breach exposed some of the most sensitive categories of personal and financial data that exist, according to breach notification letters sent to affected individuals.
This was not just names and email addresses. The stolen data went deep.
Categories of Data Confirmed as Stolen:
- Full legal names
- Social security numbers
- Dates of birth
- Physical home addresses
- Bank account numbers
- Routing numbers
- Debit card numbers
- Transaction histories
- Income information provided during account opening
- Employment information
- Phone numbers and email addresses
For customers of certain FinTech partners, additional data categories may have been included depending on what each partner shared with Evolve during account setup and verification.
| Data Type | Risk Level |
|---|---|
| Social Security Numbers | Critical: identity theft, fraud |
| Bank Account Numbers | High: financial account takeover |
| Transaction History | Medium: financial profiling |
| Debit Card Numbers | High: unauthorized charges |
| Income and Employment Info | Medium: targeted fraud |
| Contact Information | Low to Medium: phishing risk |
Social security numbers are the most dangerous piece of stolen data because they cannot be changed. Unlike a card number or password, your SSN follows you for life.
Key Takeaway: The Evolve Bank breach exposed social security numbers, account numbers, and financial histories for millions, creating serious long-term identity theft risk that is the foundation of the class action damages claim.
Evolve Bank 7.6 Million Customers Affected: The Full Scale
The scale of the Evolve Bank breach reaches approximately 7.6 million individuals, making it one of the largest banking data breaches in U.S. history.
That number is not just current Evolve Bank account holders. It includes past customers, applicants who never completed an application, and customers of FinTech companies that stored data with Evolve.
To put that in perspective: 7.6 million people is roughly the entire population of Virginia.
Who Makes Up the 7.6 Million:
- Active Evolve Bank direct customers
- Former Evolve Bank customers
- Applicants who submitted information but did not open accounts
- Customers of FinTech companies using Evolve as their banking partner
- Family members added to accounts (in some cases)
The sheer breadth of exposure is why multiple law firms filed separate class action complaints, which were later consolidated into a single coordinated proceeding in federal court.
| Victim Category | Estimated Share |
|---|---|
| Direct Evolve Bank customers | Smaller portion |
| FinTech partner customers | Majority of the 7.6 million |
| Applicants / partial signups | Included |
| Secondary account holders | Partially included |
The majority of the 7.6 million victims likely never knew Evolve Bank existed before they received a breach notification letter.
Evolve Bank FinTech Partners Affected
The evolve bank fintech partners affected section of this lawsuit is what separates this case from a standard bank data breach.
Evolve Bank operated as a “bank as a service” provider, meaning it held banking licenses and processed financial transactions on behalf of dozens of FinTech apps and platforms.
If you used any of these services, your data was likely stored at Evolve Bank.
Confirmed FinTech Companies That Used Evolve Bank as a Banking Partner:
- Stripe (Treasury product)
- Mercury
- Wise (formerly TransferWise)
- Marqeta
- Dave
- EarnIn
- Melio
- Bilt Rewards
- Bond Financial
- Nomad
- Affirm
- Airwallex
Each of these companies confirmed in notifications to their own users that Evolve’s breach had exposed their customers’ data as well.
| FinTech Partner | Service Type | Data Potentially Exposed |
|---|---|---|
| Mercury | Business banking | Account numbers, balances |
| Wise | Money transfers | Identity, account data |
| Dave | Cash advance app | SSNs, account data |
| EarnIn | Earned wage access | Income, employment, SSN |
| Bilt Rewards | Rent payment | Payment and identity info |
| Melio | B2B payments | Business and personal data |
| Stripe Treasury | Business banking API | Account numbers, transactions |
If you received a data breach notification from any of these companies in mid-to-late 2024, that notification was about the Evolve Bank breach. You are likely eligible for the class action.
Key Takeaway: Customers of popular FinTech apps including Mercury, Wise, Dave, and EarnIn are affected by the Evolve Bank breach and are likely eligible to join the class action lawsuit without ever having had a direct account with Evolve.
Who Qualifies for the Evolve Bank Class Action
You qualify for the Evolve Bank and Trust class action lawsuit if your personal or financial data was stored by Evolve Bank and exposed in the June 2024 breach.
Eligibility is broad. You do not need to have been a direct Evolve Bank customer.
You likely qualify if:
- You received a data breach notification from Evolve Bank and Trust
- You received a data breach notification from a FinTech company that used Evolve as a banking partner
- You were a customer of Evolve Bank at any point before the breach date
- You applied for an account at Evolve Bank even if you never completed the process
- You used Stripe Treasury, Mercury, Wise, Dave, EarnIn, Bilt, Melio, or other confirmed Evolve partners
You may qualify even if:
- You never heard of Evolve Bank
- You did not receive a notification letter (notification delivery is not perfect)
- You closed your account before the breach
| Eligibility Criteria | Qualifies? |
|---|---|
| Received breach notification from Evolve | Yes |
| Received breach notification from FinTech partner | Yes |
| Was an active Evolve customer in 2024 | Yes |
| Closed Evolve account before June 2024 | Likely yes |
| Applied but never opened an account | Likely yes |
| Used Mercury, Dave, EarnIn, or similar apps | Yes |
If you are unsure, the safest approach is to check whether any of the confirmed FinTech partners held an account for you during the relevant period.
Am I Affected by the Evolve Bank Data Breach
You are affected by the Evolve Bank data breach if Evolve Bank stored your personal information at the time of the June 2024 attack, regardless of whether you were directly aware of the relationship.
The most reliable indicator is a breach notification letter. But not everyone received one.
Ways to Check If You Were Affected:
- Check your email inbox and physical mail for notifications from Evolve Bank or Trust
- Check for notification emails from FinTech services you used (Mercury, Wise, Dave, EarnIn, Bilt, Melio, Stripe)
- Review your credit report for unfamiliar accounts or inquiries (available free at annualcreditreport.com from the three major bureaus)
- Look for signs of identity theft: new accounts, strange charges, or IRS tax discrepancies
Red Flags That Your Data May Have Been Misused:
- Unexpected new credit accounts in your name
- Bills or collection notices for accounts you did not open
- IRS notice about duplicate tax filing
- Strange bank transactions you did not authorize
- Calls from creditors about debts you do not recognize
| Warning Sign | Possible Cause |
|---|---|
| New accounts in your name | Identity fraud using stolen SSN |
| Unknown charges | Account number misuse |
| IRS duplicate filing notice | SSN used for fraudulent tax return |
| Collection calls for unknown debts | Account fraud downstream |
Even if you have not seen harm yet, the risk remains. Stolen SSNs are often used months or years after the initial breach, when victims have stopped watching closely.
Evolve Bank Federal Reserve Enforcement Action
The Federal Reserve issued a formal enforcement action against Evolve Bank and Trust in connection with deficiencies in the bank’s risk management and compliance framework, and this enforcement action is central to the class action lawsuit.
The Fed’s action predated the public acknowledgment of the breach and indicated regulators had already identified serious problems at Evolve before the LockBit attack became public.
This is legally significant. It shows that Evolve Bank was on notice that its operations carried elevated risk, and it took insufficient action to fix those problems.
Key Facts About the Federal Reserve Enforcement Action:
- The Federal Reserve issued a consent order against Evolve Bank and Trust
- The order cited deficiencies in anti-money laundering (AML) programs
- It also flagged weaknesses in risk management related to FinTech partnerships
- The Arkansas State Banking Department issued a parallel enforcement action
- Evolve was required to improve oversight of its FinTech partners and improve compliance systems
| Regulator | Action Type | Key Issue |
|---|---|---|
| Federal Reserve | Consent Order | AML deficiencies, FinTech oversight failures |
| Arkansas State Banking Dept. | Parallel enforcement | Compliance weaknesses |
| Timing | Prior to breach disclosure | Suggests prior knowledge of systemic risk |
Plaintiffs in the class action cite this enforcement action as evidence that Evolve’s failures were systemic and known, not accidental. That distinction matters in a negligence lawsuit.
Key Takeaway: The Federal Reserve’s pre-existing enforcement action against Evolve Bank strengthens the class action by showing the bank had documented, known compliance failures before the breach occurred.
Evolve Bank Settlement Amount and Payout
No final settlement amount has been announced in the Evolve Bank and Trust class action lawsuit as of 2026, because the case is still in active litigation.
However, based on comparable banking data breach settlements, legal analysts project meaningful per-person compensation for victims, particularly those who can document specific harm.
Comparing to similar cases gives a realistic range:
| Comparable Case | Settlement Total | Per-Person Payout |
|---|---|---|
| Capital One Data Breach (2019) | $190 million | $25 to $375 |
| T-Mobile Data Breach (2021) | $350 million | Up to $25,000 for identity theft victims |
| Equifax Data Breach (2017) | $700 million | $125 base or free credit monitoring |
| First American Financial (2019) | $1.05 billion | Varied by claim type |
For the Evolve Bank case, legal observers note several factors that will influence the final payout:
Factors That Affect Your Individual Payout:
- Whether you experienced documented identity theft or fraud
- Whether you had out-of-pocket losses (credit monitoring costs, fraud recovery expenses)
- The number of total valid claimants
- How much data was exposed for your specific record
- Whether you are a direct Evolve customer or a FinTech partner customer
Victims with documented identity theft or financial fraud losses tend to receive significantly higher payments than those who suffered only exposure risk.
Evolve Bank Class Action Compensation Tiers
Class action settlements in data breach cases typically divide compensation into tiers based on the type and severity of harm experienced.
While Evolve’s final settlement terms are not yet set, the expected tier structure will likely follow the industry standard for major banking breach cases.
Projected Compensation Tier Structure:
| Tier | Eligibility | Estimated Payout Range |
|---|---|---|
| Tier 1: Basic Exposure | All affected class members with confirmed exposure | $25 to $150 (cash or credit monitoring) |
| Tier 2: Documented Expenses | Victims with receipts for credit monitoring, fraud protection costs | $150 to $500 |
| Tier 3: Financial Fraud | Victims with documented unauthorized charges or account fraud | $500 to $2,500 |
| Tier 4: Identity Theft | Victims with documented identity theft, new fraudulent accounts, IRS disputes | $2,500 to $25,000+ |
These are projections based on comparable case structures. Actual amounts will depend on the total settlement fund and total number of valid claims filed.
What Strengthens Your Claim:
- Copies of breach notification letters
- Receipts for credit monitoring or identity protection services purchased after the breach
- Bank statements showing unauthorized charges
- Police reports filed for identity theft
- Credit reports showing fraudulent accounts
- Correspondence with creditors disputing fraudulent accounts
Start gathering documentation now. Organized records at claim time directly translate to higher compensation.
Key Takeaway: Victims with documented financial fraud or identity theft can expect meaningfully higher compensation than those with exposure only, so gathering records now is the most important step you can take before the filing deadline.
How to File an Evolve Bank Data Breach Claim
Filing a claim in the Evolve Bank class action lawsuit involves joining the litigation as a class member and submitting documentation of your exposure and any resulting harm.
As of 2026, the case is still in litigation. A formal settlement claims process has not yet been opened. But there are clear steps to take right now.
Steps to Take Before the Claims Process Opens:
- Confirm your eligibility by reviewing whether you received a breach notification from Evolve or any of its FinTech partners
- Gather documentation: breach notification letters, bank statements, credit reports, receipts for fraud protection services
- Place a credit freeze with all three major credit bureaus (Equifax, Experian, TransUnion) if you have not already
- Monitor your credit continuously for new or fraudulent accounts
- Contact a class action attorney if you have experienced identity theft or documented financial fraud; many work on contingency (no upfront cost)
- Register your interest with law firms actively managing the case to receive settlement notifications
- Keep records of all harm including time spent dealing with fraud, costs incurred, and communications with creditors
| Action | Why It Matters |
|---|---|
| Gather breach notification letter | Proves class membership |
| Document financial fraud losses | Qualifies for higher tier payout |
| Credit freeze | Prevents further harm |
| Contact attorney | Protects your rights and options |
| Register for updates | Ensures you receive settlement notice |
You do not need to hire an attorney to participate in a class action. You will automatically be included as a class member if eligible, unless you opt out.
Evolve Bank Lawsuit Filing Deadline 2026
The formal claims filing deadline for the Evolve Bank class action lawsuit has not been officially set as of early 2026, because the case has not yet reached a settlement agreement.
Deadlines are set only after a settlement is negotiated, approved by the court, and a claims administrator is appointed.
However, there are time-sensitive actions you should take regardless of where the case stands.
What You Need to Know About Deadlines:
- The statute of limitations on individual claims varies by state, typically two to three years from the date of breach discovery
- The breach was publicly confirmed in June 2024, which means individual claim windows begin closing as early as June 2026 in some states
- Once a settlement is announced, claims periods are typically 60 to 180 days
- Class members who miss the claims deadline forfeit their right to compensation from the settlement fund
| Deadline Type | Approximate Date | What It Means |
|---|---|---|
| Breach discovery date | June 2024 | Clock starts for individual claims |
| Statute of limitations (2-year states) | June 2026 | Last date to file individual lawsuits |
| Statute of limitations (3-year states) | June 2027 | Extended window |
| Expected settlement claims period | TBD in 2026 or 2027 | 60 to 180 days after court approval |
Do not wait for a formal deadline announcement. The preparation you do now determines whether you can document a claim when the window opens.
Evolve Bank Class Action Lawsuit Update 2026
As of 2026, the Evolve Bank and Trust class action lawsuit is in active litigation with discovery ongoing and no settlement announced yet.
Here is a current snapshot of where the case stands:
2026 Case Status:
- Multiple class action complaints filed in 2024 have been consolidated into a single coordinated proceeding
- Lead plaintiffs and lead counsel have been appointed by the court
- The discovery phase is underway, with plaintiffs seeking internal documents about Evolve’s cybersecurity practices, the Federal Reserve enforcement timeline, and communications about the breach
- Evolve Bank has filed responses and motions challenging aspects of the complaint
- Settlement discussions are expected to begin in earnest in 2026 based on comparable case timelines
- The Federal Reserve consent order process continues separately
| Litigation Phase | Status in 2026 |
|---|---|
| Complaints filed | Completed (2024) |
| Consolidation | Completed |
| Lead counsel appointed | Completed |
| Discovery phase | Active |
| Settlement negotiations | Anticipated 2026 |
| Trial date (if no settlement) | 2027 or later |
Cases of this size and complexity rarely go to trial. The Capital One breach case settled. The Equifax case settled. Most large banking data breach class actions resolve before trial.
The realistic expectation for Evolve is a negotiated settlement, likely announced sometime in 2026 or 2027, with a claims period to follow.
What to Do If Your Data Was Stolen From Evolve Bank
If your data was stolen in the Evolve Bank breach, the most important thing to do immediately is place a credit freeze with all three major credit bureaus, then document your harm and monitor for identity theft.
This is not a “wait and see” situation. Stolen SSNs get traded and sold on the dark web for years after a breach.
Your Action Plan Right Now:
- Place a credit freeze at Equifax, Experian, and TransUnion (free, does not hurt your credit score)
- Set up fraud alerts at all three bureaus (notifies lenders to verify your identity before opening new accounts)
- Review your credit report for accounts or inquiries you do not recognize
- Check your bank and card statements for unauthorized transactions
- File an identity theft report at IdentityTheft.gov (the FTC’s official reporting tool) if you find fraud
- Keep all records of costs and time spent dealing with fraud
- Check IRS account transcripts for signs of fraudulent tax filings
- Consider identity theft protection services and keep receipts, as costs can be claimed in the lawsuit
| Step | Priority Level | Timeframe |
|---|---|---|
| Credit freeze | Critical | Today |
| Fraud alerts | High | This week |
| Credit report review | High | This week |
| Bank statement audit | High | This week |
| IRS transcript check | Medium | This month |
| Document all harm and costs | Ongoing | Start now, continue |
| Legal consultation (if fraud found) | High | Within 30 days |
Identity theft victims who take these steps and document their experience carefully are the same people who receive the highest compensation when a settlement fund opens.
Key Takeaway: Taking protective action now, especially placing a credit freeze and documenting all fraud-related costs, is not just self-protection. It directly improves your compensation position when the Evolve Bank settlement claims process opens.
Frequently Asked Questions
Who qualifies for the Evolve Bank and Trust class action lawsuit?
Anyone whose personal or financial data was stored by Evolve Bank and exposed in the June 2024 breach likely qualifies.
This includes direct Evolve Bank customers, former customers, applicants, and customers of FinTech companies like Mercury, Wise, Dave, EarnIn, and Bilt that used Evolve as their banking partner.
You do not need to have been a direct Evolve customer to be eligible.
How much money can I get from the Evolve Bank data breach settlement?
No settlement has been finalized as of 2026, but comparable cases suggest payouts ranging from $25 to $150 for basic exposure claims and up to $25,000 or more for documented identity theft.
Your exact amount depends on the severity of harm you experienced and the documentation you can provide.
Victims with fraud losses or identity theft consistently receive higher payouts than those with exposure only.
How do I file a claim in the Evolve Bank class action lawsuit?
A formal claims process is not yet open as of 2026, because the case is still in litigation.
When a settlement is reached, a claims administrator will be appointed and a claims filing window of typically 60 to 180 days will open.
The best thing to do now is gather your documentation and register interest with attorneys handling the case so you receive notification when the claims process opens.
What data was stolen in the Evolve Bank and Trust breach?
The breach exposed social security numbers, bank account and routing numbers, debit card numbers, dates of birth, home addresses, phone numbers, transaction histories, and income information.
SSNs are the most dangerous category because they cannot be replaced and are used for identity fraud for years after a breach.
If you were notified by Evolve or any FinTech partner, assume your most sensitive data was included.
Is the Evolve Bank class action lawsuit still active in 2026?
Yes, the Evolve Bank and Trust class action lawsuit is still active in 2026, currently in the discovery phase with no settlement yet announced.
Lead counsel has been appointed and discovery is underway, with settlement negotiations expected to begin during 2026.
The case is expected to resolve through a negotiated settlement, as is typical for large banking breach class actions, rather than going to trial.
Your Next Move Is Time-Sensitive
The Evolve Bank and Trust class action lawsuit is one of the largest banking breach cases in recent history. Millions of people have a legitimate claim, and the litigation is moving forward.
Place that credit freeze today. Pull your credit report this week. Gather every breach notification letter you received, every receipt for fraud protection, every record of unauthorized charges.
The people who walk into a settlement claims period with organized documentation walk out with meaningfully higher compensation than those who show up empty-handed. Your preparation right now is your strongest legal asset.
