Flagstar Bank flagstar.com Flagstar Bank data breach: what happened and what to do
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
In May 2023 attackers took data from Fiserv, a Flagstar Bank vendor, through a MOVEit flaw. Flagstar notified 837,390 people in October 2023. Names and Social Security numbers were exposed.
View all 13,118 breaches- Breach date
- 27 May 2023
- Made public
- 5 Oct 2023
- Affected
- 837,390
- Data exposed
- Names, Social security numbers
- Last updated
What happened
In October 2023, Flagstar Bank told customers that their personal information was taken in a breach at Fiserv, a vendor that handles payment processing and mobile banking for the bank. The attackers got in through a flaw in MOVEit Transfer, a file-transfer tool that Fiserv used. Fiserv's investigation put the intrusion between May 27 and May 31, 2023, before the flaw was publicly known. Flagstar reported the incident to the California Attorney General on October 5, 2023.
Flagstar said the problem sat with its vendor and did not affect its own systems or its ability to serve customers. News reports put the number of people notified at 837,390.
Sources checked: oag.ca.gov, securityaffairs.com, infosecurity-magazine.com
Last verified against the official page:
What was exposed
The sample notification letters leave out the data types, but the entry on the Maine Attorney General's breach portal lists at least names and Social Security numbers. That combination is what identity thieves need to open credit in someone else's name, so treat this as an identity theft risk, not just a spam risk.
What Flagstar did
The bank offered affected customers two years of identity monitoring through Kroll. Flagstar had also reported earlier, separate incidents in 2021 and 2022, which are different events from this one.
What it means for you
If you got a letter, use the monitoring offer. If you banked with Flagstar and didn't get one, you are probably fine, but a credit freeze costs nothing and takes a few minutes.
What to do if you were in it
- 1
Use the free identity monitoring
If you got a letter, it has a code for 2 years of monitoring through Kroll. Sign up with the code in the letter and check the deadline.
- 2
Freeze your credit at all three bureaus
Social Security numbers were exposed, so freeze your file at Equifax, Experian and TransUnion. It's free and you can lift it when you apply for credit. The FTC explains how: https://consumer.ftc.gov/articles/what-know-about-credit-freezes-and-fraud-alerts
- 3
Watch your bank and credit card statements
Look for accounts or charges you don't recognize, and check your credit reports once a year at AnnualCreditReport.com.
- 4
Expect phishing that mentions the bank
Scammers reuse breach news. Don't click links in texts or emails about your Flagstar account; open the bank's app or type the address yourself.
- 5
Check whether your email or phone is in this and other breaches
Run a free scan with Serus at https://www.serus.ai to see where your email or phone number has turned up.
Official filings
- Oregon Department of Justice , filed 6 Oct 2023
- California Attorney General , filed 5 Oct 2023
Timeline
-
The breach happened
-
The company made it public
-
Reported to the California Attorney General
-
Reported to the Oregon Department of Justice
Frequently asked
Was I affected by the Flagstar Bank data breach?
Flagstar mailed letters to the people it identified as affected, around 837,000 in total. If you didn't get one, you were most likely not on the list.
What was exposed in the Flagstar breach?
At least names and Social Security numbers, according to the Maine Attorney General's breach portal entry.
Who was behind the breach?
Flagstar's vendor Fiserv was hit through a flaw in MOVEit Transfer. The bank's own systems were not the entry point.
Should I freeze my credit?
Yes, if your Social Security number was in the notice. A freeze is free and stops new credit being opened in your name.
Sources
- Search Data Security Breaches | State of California - Department of Justice · oag.ca.gov
- Flagstar Bank suffered a data breach once again · securityaffairs.com
- Flagstar Bank MOVEit Breach Affects 800K Customer Records · infosecurity-magazine.com
- paymentsdive.com/news/fiserv-moveit-victim-cyberattack-breach-flagstar-bank-fis/696034
- consumer.ftc.gov/articles/what-know-about-credit-freezes-and-fraud-alerts
Something wrong or out of date? Tell us and we'll re-check it.
