Billion-Dollar Bank Handing $2,400,000 To Customers and Attorneys In Settlement Over Data Breach That Impacted 204,291 People

A US bank is preparing to hand out millions of dollars after a data breach exposed customers’ personal information.

The Nebraska-based Union Bank and Trust Company (UBT) has agreed to shell out $2.4 million to settle a class action lawsuit accusing the lender of failing to implement or maintain adequate data security measures to protect customers’ private information.

According to the lawsuit, the “CL0P Ransomware Gang” committed a cyberattack in May 2023 that exploited the bank’s third-party MOVEit file-transfer software, developed by Progress Software Inc., to gain access to customers’ personal information.

Progress warned the bank of an “unauthenticated SQL vulnerability that could allow unauthorized actors to escalate user privileges and access UBT’s MOVEit Transfer environment.”

Once notified, UBT took “MOVEit offline and installed patches to fix the vulnerability.” However, the bank’s investigation found that personal information of about 204,291 customers “had been potentially taken” before the vulnerability was fixed.

UBT denies the allegations and any liability, but says it has agreed to settle the matter. The settlement is pending court approval.

Under the proposed agreement, the funds will be used to pay for reimbursement of up to $10,000 for documented losses due to misuse of their data or a cash payment of $100, as well as two years of credit monitoring and identity theft protection for the impacted customers.

The settlement will also pay for administrative costs and attorneys’ fees.

Founded in 1917, UBT is headquartered in Lincoln, Nebraska, and has about $9 billion in assets under management.

Generated Image: Midjourney