A ransomware group calling itself Storm has listed five US banks and a credit union as victims on its leak site, and two of the six institutions have confirmed breaches, American Banker reported on 11 November.

Sawyer Savings Bank of Saugerties, New York, said its breach began on 3 August inside its managed service provider’s systems. The bank closed its branches for a week in August, and later told 16,069 people that files containing names and Social Security numbers had been taken. Letters were mailed on 9 October.

Credit union confirms breach

Insight Credit Union, based in Winter Springs, Florida, reported a breach to the Texas and Vermont attorneys general on 6 November, identifying 656 affected Texas residents. Its filing put the total at 67,487, and said the incident took place between 4 and 7 September and was discovered on 13 October. Exposed data included names, Social Security numbers, driver’s licence numbers, other government IDs and financial account and card details, teiss reported.

Storm had claimed on 15 September that it had taken 209 gigabytes of data from the credit union and would publish it within 17 days. The credit union has not publicly confirmed the group’s claim, and a listing on a leak site is a claim, not a verified forensic finding.

The other four banks named — Pioneer Bank in Albany, New York; The Cecilian Bank in Cecilia, Kentucky; First Secure Bank Group in Illinois; and The Poca Valley Bank in Walton, West Virginia — had not confirmed or denied an incident. The five banks hold about $6.1 billion in assets between them, and all six institutions about $6.7 billion. Microsoft links the leak site to a group it calls Storm-1175, which it has said was likely exploiting a flaw in software used by managed service providers.