Cadence Bank cadencebank.com Cadence Bank data breach: what happened and what to do
Cadence Bank said an outside party exploited a flaw in the MOVEit Transfer file tool and downloaded data on May 28 to 31, 2023. Data may include names, addresses, birth dates, Social Security numbers and account details.
View all 13,115 breaches- Breach date
- 28 May 2023
- Data exposed
- Names, Physical addresses, Dates of birth, Social security numbers, Driver's licenses, Financial account information
- Last updated
What happened
Cadence Bank is one of the many organizations hit through MOVEit Transfer, a file-transfer product from Progress Software. The bank said it learned of a previously unknown (zero-day) flaw in the product on June 1, 2023. By June 18 it had determined that an unauthorized party used the flaw and downloaded information stored in its MOVEit application between May 28 and 31, 2023.
The bank announced on September 15, 2023 that it would notify people whose sensitive information was involved. Its notice letters say the data may have included name, address, date of birth, Social Security number, driver's license number and financial account information. The bank said it wasn't aware of any actual fraud or identity theft tied to the data. Later notices, sent after its data analysis finished on November 25, 2023, reached people connected to some of the bank's business customers, for example health plan members.
The bank advised people to monitor account statements, get a free credit report and consider fraud alerts or credit freezes, and warned about phishing calls, emails and texts.
Social Security and account numbers don't change, so the risk lasts for years. Criminals can use them to open accounts in your name or to make phishing messages sound convincing.
What to do if you were in it
- 1
Freeze your credit
Place a free freeze with Equifax, Experian and TransUnion. It blocks most new accounts opened in your name and you can lift it when you need credit.
- 2
Watch your accounts and statements
Check bank and card activity weekly for a few months, and read any explanation-of-benefits mail you get.
- 3
Be careful with calls and texts
Messages that mention Cadence Bank or your account may be scams. Call the bank on the number printed on your card or statement.
- 4
Use the credit monitoring if you were offered it
Your notice letter explains how to sign up.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. It checks breach databases and the dark web for your email and phone number and tells you what to do next.
Frequently asked
Was I affected by the Cadence Bank data breach?
Cadence mailed notices to the people whose data was involved. If you didn't get one, you can contact the bank through the number on its website.
What was exposed?
According to the bank's notices, possibly names, addresses, dates of birth, Social Security numbers, driver's license numbers and financial account information.
Was this only Cadence Bank?
No. The MOVEit flaw hit many organizations, and each one reported its own incident.
Sources
- cdn.cadencebank.com/about/news-and-stories/news/cadence-bank-provides-moveit-global-cybersecurity-incident-update
- oag.ca.gov/system/files/2024-01-26%20-%20Individual%20Notice%20Templates%20-%20CA.pdf
- teiss.co.uk/news/news-scroller/mississippis-cadence-bank-said-hackers-exploited-moveit-transfer-app-to-access-customer-data-12874
Something wrong or out of date? Tell us and we'll re-check it.
