The evolve class action lawsuit is real, active, and moving through federal court right now. Millions of people had their most sensitive financial data stolen, and many of them still don’t know they were affected.
The breach happened in mid-2024 when a ransomware gang called LockBit hit Evolve Bank and Trust. The attack exposed Social Security numbers, bank account details, and contact information for an estimated 7.6 million individuals.
What makes this case unusual is the reach. Evolve didn’t just serve direct customers. It was the banking backbone for dozens of popular fintech apps, meaning users of Wise, Mercury, Affirm, and others had their data sitting inside Evolve’s systems without many of them realizing it.
This article covers who qualifies, what the settlement might pay, how to file a claim, and where the case stands heading into 2026.
What Is the Evolve Class Action Lawsuit?
The Evolve class action lawsuit is a group legal action filed against Evolve Bank and Trust following a massive cybersecurity breach in June 2024. Plaintiffs allege the bank failed to protect customer data, exposing millions of people to identity theft, fraud, and financial harm.
A class action groups many individual victims under one legal umbrella. Instead of each person suing separately, one or more named plaintiffs represent everyone who suffered similar harm.
The core legal claims include negligence, breach of implied contract, and unjust enrichment. Plaintiffs argue Evolve collected personal data, profited from it, and then failed to keep it safe with basic security measures.
| Case Element | Detail |
|---|---|
| Defendant | Evolve Bank and Trust |
| Breach Date | June 2024 |
| Attack Type | LockBit ransomware |
| Estimated Victims | 7.6 million individuals |
| Legal Claims | Negligence, breach of contract, unjust enrichment |
| Court | Federal district court |
The suit seeks financial compensation for victims and demands that Evolve overhaul its data security practices. Multiple separate class action complaints were filed, and courts are expected to consolidate them into one coordinated proceeding.
The Evolve Bank Data Breach Lawsuit: How It Started
The Evolve Bank data breach lawsuit formally began when the first complaint was filed in late June 2024, just days after the bank publicly confirmed the attack. That speed tells you how serious the harm was considered from day one.
Attorneys who specialize in data breach litigation started investigating almost immediately after news broke. The first plaintiffs came forward claiming they had already received fraudulent account activity linked to the breach.
The Federal Reserve moved quickly too. Regulators issued a consent order against Evolve Bank in the weeks following the breach, citing anti-money laundering failures and weak risk management. That regulatory action gave plaintiffs additional ammunition in court.
Key facts about how the lawsuit started:
- First class action complaint filed: Late June 2024
- Federal Reserve consent order issued: Shortly after breach disclosure
- Number of separate complaints filed: Multiple, across different federal districts
- Breach publicly confirmed by Evolve: June 26, 2024
The speed of the legal response reflects the severity of the breach. Courts took notice, and by mid-2024, motions to consolidate the various complaints were already in progress.
Evolve Bank and Trust Lawsuit: Who Filed and Where
The Evolve Bank and Trust lawsuit involves multiple named plaintiffs from different states, each representing a class of similarly affected consumers. The cases were filed in federal courts across the country.
Filing in federal court is standard for data breach class actions of this size. The Class Action Fairness Act allows these cases to be heard federally when the amount in controversy exceeds $5 million and the class spans multiple states, both of which clearly apply here.
Named plaintiffs in early filings included individuals from states like California, Tennessee, and Texas. Law firms with data breach class action experience are leading the charge, building the evidentiary record needed for class certification.
| Filing Detail | Information |
|---|---|
| Filing Jurisdiction | Federal district courts |
| Named Plaintiffs | Multiple individuals from multiple states |
| Lead Law Firms | Specialized data breach class action firms |
| Consolidation Status | Motions filed, consolidation expected |
| Governing Law | Class Action Fairness Act |
Consolidation into a multidistrict litigation or single coordinated proceeding is likely. That process can take several months but ultimately makes the litigation more efficient for both plaintiffs and the court.
The LockBit Ransomware Attack on Evolve Bank Explained
The LockBit ransomware attack on Evolve Bank is one of the most consequential cyberattacks against a financial institution in recent memory. LockBit is a sophisticated cybercriminal group known for encrypting victims’ systems and threatening to publish stolen data unless a ransom is paid.
In Evolve’s case, the group carried out what’s called a double extortion attack. They exfiltrated data first, then encrypted systems. When Evolve didn’t pay the ransom, LockBit published roughly 33 gigabytes of stolen data on the dark web.
That data dump is what makes this breach so harmful. Once data is published on the dark web, it cannot be taken back. Victims face ongoing risks of identity theft for years.
What LockBit did, step by step:
- Gained unauthorized access to Evolve’s internal systems
- Stole massive volumes of customer and partner data
- Encrypted some systems to disrupt bank operations
- Demanded a ransom payment from Evolve
- Published the stolen data publicly when Evolve refused
The FBI has flagged LockBit as one of the most prolific ransomware operations in history. The fact that this group specifically targeted a bank holding fintech partner data amplified the damage significantly beyond what a typical single-institution breach would cause.
Key Takeaway: The LockBit attack on Evolve Bank was a double extortion ransomware event that resulted in stolen data being publicly released, creating lasting harm for millions of victims who cannot undo the exposure.
What Personal Information Was Stolen in the Evolve Bank Data Breach?
The Evolve Bank data breach exposed a wide range of highly sensitive personal and financial information. According to the bank’s own breach notification, the stolen data included names, Social Security numbers, dates of birth, account information, and contact details.
For many victims, Social Security number exposure is the most serious element. That single piece of data can be used to open fraudulent credit accounts, file fake tax returns, and access government benefits.
Bank account numbers and routing information were also part of the stolen dataset. That means some victims face direct financial theft risk, not just identity theft.
Data types confirmed stolen:
- Full legal names
- Social Security numbers
- Dates of birth
- Bank account numbers and routing numbers
- Email addresses
- Phone numbers
- Physical mailing addresses
- Some transaction history data
The scale matters here. Roughly 7.6 million individuals had their data exposed. For context, that’s more people than the entire population of the state of Washington. The breadth of the exposure is why courts are treating this with urgency.
Evolve Bank Lawsuit Eligibility: The Basic Requirements
Evolve Bank lawsuit eligibility is based on whether your personal information was held by Evolve Bank and Trust and exposed during the June 2024 breach. You do not need to have been a direct Evolve Bank customer to qualify.
The broad eligibility criteria is one of the most important and least understood aspects of this case. Because Evolve served as the banking infrastructure for dozens of fintech companies, the pool of potential class members is enormous.
Basic eligibility requirements generally include:
| Requirement | What It Means |
|---|---|
| Data held by Evolve | Your personal info was stored in Evolve’s systems |
| Breach window | Information was exposed in the June 2024 breach |
| Harm or risk of harm | You suffered or face identity theft, fraud, or related harm |
| U.S. residency | Most class members are U.S. residents |
| No prior settlement | You haven’t already received compensation from Evolve |
You don’t need to prove you’ve already suffered financial loss. Courts in data breach cases regularly accept increased risk of future harm as sufficient injury to establish standing. This is a well-established legal standard in federal courts.
Evolve Bank Data Breach: Who Qualifies to File a Claim?
Anyone whose data was stored by Evolve Bank and Trust before June 2024 may qualify to file a claim in the class action. That includes direct customers, fintech app users whose accounts were backed by Evolve, and business account holders.
The qualifying group breaks down into several categories. Think of it like concentric circles: direct bank customers in the center, then fintech app users in the next ring, then business clients and professional account holders further out.
Who likely qualifies:
- People who held personal checking or savings accounts directly with Evolve Bank
- Users of fintech apps that partnered with Evolve for banking infrastructure
- Small business owners whose accounts were processed through Evolve
- Anyone who received a data breach notification letter from Evolve Bank or one of its fintech partners
- Individuals whose Social Security numbers, account numbers, or contact details were confirmed in the breach dataset
Who likely does not qualify:
- People with no connection to Evolve or its fintech partners
- Individuals whose data was not included in the stolen dataset
- Those who have already entered a separate legal settlement with Evolve
If you received any breach notification letter, save it. It’s documentary proof of your connection to this case.
Evolve Bank Fintech Partners Affected by the Breach
The Evolve Bank fintech partner situation is what separates this breach from most banking data cases. Evolve didn’t just hold its own customers’ data. It was the back-end banking infrastructure for a wide range of consumer fintech products.
This is how banking-as-a-service works. Tech companies build apps that offer financial products like payment accounts, debit cards, and payment processing. But behind the scenes, an FDIC-insured bank like Evolve actually holds the money and the data.
Consumers using these apps often had no idea Evolve was involved. They signed up for a Wise account or an EarnIn account, and they gave their personal information to that app, never knowing it was being stored at Evolve Bank’s servers.
Confirmed fintech companies that partnered with Evolve:
- Wise (international money transfers)
- Mercury (business banking for startups)
- Affirm (buy now, pay later)
- Bilt Rewards (rent payments and rewards)
- EarnIn (earned wage access)
- Stripe (payment processing infrastructure)
- Several additional fintech platforms under review
Each of these companies sent breach notifications to their own users after Evolve confirmed the attack. If you use any of these services and received a notification, you’re likely part of the affected class.
Key Takeaway: The fintech partner network is why this breach affected so many people who have never heard of Evolve Bank. If you use any fintech app, check whether they sent you a data breach notice in mid to late 2024.
Wise, Mercury, and Affirm Users: Are You Part of the Evolve Breach?
Users of Wise, Mercury, and Affirm are very likely part of the Evolve data breach class, and many have already been identified as potential plaintiffs. These three companies alone represent tens of millions of customers whose banking data was processed through Evolve’s infrastructure.
Wise users had their personal identification data and payment account information stored in Evolve’s systems. Mercury, which serves startup founders and small businesses, had business account data exposed. Affirm users’ personal financial information was part of the stolen dataset as well.
Each company issued its own breach notification to affected users. The language in those letters confirms the connection to Evolve Bank specifically.
| Company | User Type | Data Exposed |
|---|---|---|
| Wise | Individual and business transfer users | Names, account info, identification data |
| Mercury | Startup founders, small businesses | Business and personal account data |
| Affirm | Buy now, pay later customers | Personal financial and identity data |
| Bilt Rewards | Renters with rewards accounts | Account and personal information |
| EarnIn | Wage advance users | Employment and personal data |
If you received a breach notification from any of these companies referencing the Evolve Bank incident, that letter is your ticket into this lawsuit. Keep it in a safe place.
Evolve Bank Settlement 2026: Where Things Stand Now
The Evolve Bank settlement process in 2026 is still in its earlier phases, with litigation ongoing and no final settlement approved as of the start of 2026. Class certification hearings and discovery are the current focus.
This is normal for large data breach class actions. Cases of this complexity typically take two to four years from filing to final settlement approval. The 2024 filing date puts a potential settlement in the 2026 to 2027 range.
The Federal Reserve’s consent order against Evolve Bank may influence settlement negotiations. Regulators have already established that the bank had compliance failures, which strengthens the plaintiffs’ hand at the negotiating table.
2026 Litigation Roadmap:
| Phase | Expected Timing |
|---|---|
| Discovery period | Ongoing through mid-2026 |
| Class certification motion | 2026 |
| Class certification ruling | Mid to late 2026 |
| Settlement negotiations | Late 2026 or early 2027 |
| Preliminary settlement approval | 2027 (projected) |
| Final settlement approval | 2027 to 2028 (projected) |
Patience is required here. But the class size and severity of the breach make a significant settlement fund a realistic outcome. The bigger the class, the more leverage plaintiffs have in negotiations.
How Much Will the Evolve Bank Settlement Pay?
The Evolve Bank settlement payout will vary based on the severity of harm each claimant experienced and the total size of the settlement fund negotiated. No final number has been announced because no settlement has been reached yet.
That said, comparable data breach settlements give us a reasonable framework. The Capital One data breach settlement in 2023 resulted in a $190 million fund. The Yahoo data breach settlement paid out $100 per person to many claimants. Equifax settled for $575 million after exposing 147 million people’s data.
Given that Evolve’s breach exposed approximately 7.6 million individuals’ data, a total settlement fund in the $50 million to $200 million range is within the realistic spectrum based on these precedents.
Potential payout tiers based on data breach settlement patterns:
| Claimant Category | Estimated Compensation Range |
|---|---|
| Basic data exposure, no documented harm | $50 to $150 |
| Documented fraud or identity theft attempts | $200 to $500 |
| Proven financial losses tied to the breach | $500 to $2,500 or more |
| Named plaintiffs / class representatives | Higher amounts, case specific |
| Credit monitoring claims reimbursement | Up to $25 per month, capped |
These are estimates based on prior settlements. The actual numbers depend on negotiations, the total number of claimants, and what evidence of harm can be documented.
Key Takeaway: No final settlement amount has been set, but based on comparable data breach cases, individual payouts could range from $50 for basic exposure to over $2,500 for those who suffered documented financial losses.
Evolve Bank Settlement Payout Amount: Realistic Expectations
Setting realistic expectations about the Evolve Bank settlement payout amount matters because too many people expect a windfall from class action lawsuits and walk away disappointed. Here’s the honest picture.
Most class members in data breach settlements receive relatively modest amounts. The legal system acknowledges that proving exact dollar losses from data exposure is difficult. That’s why settlements typically offer tiered compensation based on what claimants can document.
The factors that most influence your individual payout are straightforward: how much of your data was exposed, whether you suffered actual financial harm, and whether you can provide supporting documentation.
What increases your potential payout:
- Documented identity theft events tied to the breach timeline
- Bank fraud or unauthorized account activity following the breach
- Costs you paid for credit monitoring or identity protection services
- Professional costs related to restoring your identity or credit
- Time spent dealing with fraud consequences (some settlements compensate this at an hourly rate)
What limits your payout:
- Large number of claimants splitting a fixed settlement fund
- Lack of supporting documentation for claimed losses
- Difficulty proving causation between the breach and specific harm
Think of it like a pizza. The total settlement fund is the pizza. The more claimants, the smaller each slice. Documenting your losses makes your slice slightly bigger, but it’s still one slice from a finite pie.
Evolve Bank Lawsuit Filing Deadline: Do Not Miss This
The Evolve Bank lawsuit filing deadline has not yet been officially set because no settlement has been finalized. But that does not mean you should wait. Filing or registering your interest now protects your rights.
In most class action lawsuits, once a settlement is approved, the court sets a claims submission deadline. That window is often 60 to 90 days. Miss it and you lose your right to compensation, even if you fully qualify.
The best strategy right now is to document your harm while memories are fresh, preserve any breach notification letters you received, and watch for official settlement announcements.
What to do right now, before the deadline is set:
- Locate and save any breach notification letter from Evolve Bank or a partner company
- Gather bank statements showing any unauthorized activity from mid-2024 onward
- Document any costs you incurred for credit monitoring or fraud protection
- Note any time you spent addressing fraud or identity theft issues
- Check your credit reports for any accounts you didn’t open
Typical class action deadline structure:
| Milestone | Typical Timeframe After Settlement |
|---|---|
| Settlement announced | Day 0 |
| Claims portal opens | Within 30 days |
| Claims submission deadline | 60 to 90 days after portal opens |
| Objection deadline | 60 days after announcement |
| Final approval hearing | 90 to 120 days after announcement |
When the deadline is announced, it will be posted on the official settlement administrator’s website. The settlement notice will also be mailed to known class members.
How to File an Evolve Bank Claim Step by Step
Filing an Evolve Bank claim will be done through an official claims portal once a settlement is approved and a claims administrator is appointed by the court. The process is designed to be straightforward for non-lawyers.
You do not need to hire your own attorney to file a claim as a regular class member. Class counsel represents the entire class. You simply submit your information through the portal when it opens.
Step by step process (once settlement is approved):
- Watch for an official notice mailed to your address on file or emailed to you
- Go to the official settlement website listed in that notice
- Enter your claim ID number from the notice letter
- Fill out the online claim form with your personal information
- Select the type of harm you experienced from the available categories
- Upload any supporting documentation (fraud reports, bank statements, receipts)
- Submit the form before the deadline
- Save your confirmation number
Supporting documents worth gathering now:
- Breach notification letter from Evolve or a partner company
- Police report if you filed one for identity theft
- FTC identity theft report
- Bank statements showing unauthorized transactions
- Receipts for credit monitoring services
- Credit reports showing unauthorized inquiries or accounts
The claim form will ask you to certify that the information you provided is accurate. Don’t overstate losses. Accuracy protects both your claim and the integrity of the settlement fund.
Key Takeaway: Filing an Evolve Bank claim requires nothing more than completing an online form through the official settlement portal. The key is gathering your documentation now, before the deadline is announced.
Evolve Bank Class Action Status 2026: Current Court Progress
The Evolve Bank class action status heading into 2026 shows a case in active litigation with discovery ongoing, consolidation proceedings moving forward, and class certification expected to be the next major legal milestone.
Multiple complaints filed in mid-2024 are being consolidated. Courts handling data breach class actions of this scale routinely combine related cases into one coordinated proceeding, which is more efficient and produces a single settlement that covers all victims.
Class certification is the pivotal legal hearing in any class action. The judge must decide whether the group of plaintiffs is large enough, whether their claims are similar enough, and whether the case can realistically be resolved on a class-wide basis.
Where the case stands in 2026:
| Litigation Stage | Status |
|---|---|
| Complaints filed | Complete (multiple filed in 2024) |
| Consolidation | In progress or complete |
| Discovery | Ongoing through 2026 |
| Class certification motion | Expected in 2026 |
| Class certification ruling | Expected mid to late 2026 |
| Settlement negotiations | Likely late 2026 or beyond |
Evolve Bank’s defense attorneys have filed or are expected to file motions to dismiss some claims. This is standard litigation strategy and doesn’t mean the lawsuit is in trouble. Courts rarely dismiss entire data breach class actions at this stage.
Evolve Bank Lawsuit Update 2026: What Happens Next
The most important Evolve Bank lawsuit update for 2026 is this: class certification is the next major battleground, and the outcome of that hearing will shape everything else. If the class is certified, Evolve faces enormous pressure to settle.
Defendants in data breach cases almost never want a certified class to go to trial. The math is brutal for them. A successful trial verdict against a certified class of 7.6 million people could be financially catastrophic. That’s why settlements tend to follow certification rulings fairly quickly.
For victims, the actionable steps in 2026 are clear.
What to watch for in 2026:
- Class certification motion filing and hearing dates
- Judicial rulings on motions to dismiss
- Any early settlement discussions or mediation sessions
- Official announcement of a settlement administrator
- Launch of the official claims website
What you should do in 2026:
- Keep your contact information current with any fintech companies you used that were affected
- Monitor news about the case from reputable legal news sources
- Preserve all documentation related to the breach and any harm you experienced
- Do not respond to unsolicited calls or emails claiming to be related to this lawsuit (those are often scams)
The case isn’t over, but it’s moving. Victims who stay informed and document their harm are best positioned to benefit from whatever resolution the court ultimately approves.
Frequently Asked Questions
What is the Evolve Bank class action lawsuit about?
The Evolve Bank class action lawsuit is a legal action against Evolve Bank and Trust for failing to protect customer data during a June 2024 ransomware attack.
The LockBit ransomware group stole personal and financial information from approximately 7.6 million individuals.
Plaintiffs claim the bank’s negligence exposed them to identity theft and financial harm.
Who qualifies to join the Evolve Bank data breach lawsuit?
Anyone whose personal data was stored by Evolve Bank and Trust before the June 2024 breach likely qualifies.
This includes direct Evolve Bank customers and users of fintech apps like Wise, Mercury, Affirm, Bilt, and EarnIn.
If you received a breach notification letter from Evolve or any of these companies, you are likely a class member.
How much money can I get from the Evolve Bank settlement?
No settlement has been finalized yet, so exact amounts cannot be confirmed.
Based on comparable data breach settlements, basic claimants could receive $50 to $150, while those with documented fraud losses could receive $500 or more.
The total settlement fund and number of claimants will determine individual payment amounts.
What is the deadline to file an Evolve Bank claim?
No official filing deadline has been set because the settlement has not been finalized.
Once a settlement is approved, courts typically give claimants 60 to 90 days to submit their claims.
Watch for an official notice in the mail or email from the settlement administrator when that happens.
How do I know if my data was exposed in the Evolve Bank breach?
Check whether you received a data breach notification letter from Evolve Bank or any of its fintech partners in mid to late 2024.
You can also check your credit reports for unauthorized accounts or inquiries that appeared after June 2024.
Evolve Bank was required by law to notify all individuals whose data was confirmed to be in the stolen dataset.
Where This Case Goes From Here
The Evolve class action lawsuit is one of the more significant data breach cases moving through federal courts right now. The combination of a major ransomware attack, a broad fintech partner network, and confirmed regulatory violations against Evolve creates real legal leverage for millions of victims.
If you were affected, start gathering your documentation today. Breach notification letters, bank statements, credit monitoring receipts, and any evidence of unauthorized activity all strengthen your position.
The settlement portal isn’t open yet. But when it is, you’ll be ready. Stay connected to reputable news sources covering this case, and don’t ignore any official mail or email about a settlement. That notice is your window to compensation.
