By 
Flagstar Bank announced a data breach suffered by a third-party service provider Fiserv in which the personal information of over 800,000 US customers were stolen.
Flagstar Bank is an American commercial bank headquartered in Troy, Michigan, now owned by the New York Community Bank. It is one of the largest residential mortgage servicers in the United States, and was among the largest banks in the United States prior to its acquisition in 2022.
Fiserv which provides payment processing and mobile banking services to Flagstar Bank became the victim of the large-scale MOVEit campaign.
According to the data breach notification sent to the impacted customers, the incident involved vulnerabilities discovered in MOVEit Transfer, a file transfer software used by the vendor to support services it provides to Flagstar and its related institutions.
The vendors promptly launched an investigation into the nature and scope of the MOVEit vulnerability’s impact on its systems and discovered that the unauthorized activity in the MOVEit Transfer environment occurred between May 27 and 31, 2023, which was before the existence of this vulnerability was publicly disclosed.
The financial organization pointed out that the MOVEit flaw did not involve any of Flagstar Bank’s systems and did not impact its ability to service the customers.
After Flagstar became aware of the data breach it launched an investigation into the incident to determine the scope of the security incident. The bank started warning 837,390 US customers whose personal information were stolen.
In June 2022, Flagstar Bank disclosed another data breach that impacted roughly 1.5 million individuals, but the company did not share details about the attack. The security breach took place in early December 2021.
On March 2021, the bank became the victim of another attack conducted by the Clop ransomware gang.
Image Credit : Cnet
