Evolve Bank & Trusts reaches $11.8M settlement to end data breach claims

Update: 

• Evolve Bank & Trust has agreed to pay $11.8 million to settle class action claims of negligence, after cybercriminals stole customer information from the bank in a major data breach. 
• The plaintiffs filed a motion for preliminary approval of the settlement on April 1, 2025 in Tennessee federal court, where more than 20 class action lawsuits that accuse Evolve Bank & Trust of negligence were centralized.
• According to the proposed settlement, class members can receive up to $3,000 per claimant for any losses incurred due to the breach or choose a $20 prorated “flat cash” payment. Members will also be entitled to one year of credit monitoring and identity theft insurance coverage.
• The Evolve Bank data breach of June 26, 2024, involved customers’ names, Social Security Numbers, dates of birth, account information and other personal information.
• Under the settlement, Evolve has also agreed to strengthen its data security practices.

Evolve Bank data breach class actions overview:

• Who: Three people filed three separate lawsuits against Evolve Bank on the same day.
• Why: The plaintiffs say a threat actor stole their private information from Evolve Bank’s servers in a preventable data breach.
• Where: Two of the Evolve Bank lawsuits are filed in an Arkansas federal court, one is filed in a Tennessee federal court. 

(July 5, 2024)

Consumers hit Evolve Bank with three different lawsuits on the same day last week after cybercriminals stole customer information in a major data breach the plaintiffs say was preventable.

Each of the three recent class action lawsuits against Evolve Bank & Trust were filed on June 28—two in an Arkansas federal court and one in a Tennessee federal court. 

The plaintiffs sued Evolve Bank for negligence and other breaches of state and federal law after the bank was hit with a cyberattack June 26. 

Evolve investigated and found the data breach involved customers’ names, Social Security Numbers, dates of birth, account information and other personal information.

“The exposed private information of plaintiff and class members can—and likely will—be sold on the dark web,” according to a class action lawsuit filed by plaintiff Gabriel Stiritz. 

Evolve Bank reckless, negligent, class actions allege

Stiritz’ class action claims the bank identified the cyberattack June 26 and then reached out to affected customers with a notice. 

The notice allegedly says Evolve Bank was investigating a cybersecurity incident involving a known cybercriminal organization that illegally obtained and released the data and personal information of some Evolve retail bank customers and financial technology partners’ customers on the dark web.

The class action lawsuit claims Evolve stored customer information on the bank’s computer system and network in a condition vulnerable to cyberattack. 

“Plaintiff and class members now face a lifetime risk of identity theft, which is heightened here by the loss of Social Security numbers-the gold standard for identity thieves,” the Evolve Bank data breach class action says.

Evolve Bank waited too long to tell customers, lawsuit alleges

Meanwhile, plaintiff Duncan Meadows, who filed his class action lawsuit in Tennessee, says Evolve Bank failed to provide him and other affected customers with timely and adequate notice of the data breach, including information about how it occurred, when it occurred and when the information was released onto the dark web. 

“Defendant waited until June 26, 2024, to provide the barest of notice to the Class, only telling them that the breach occurred, that their information was now made available on the dark web by a ‘known cybercriminal organization,’ and that the information involved the most sensitive of [personally identifiable information],” the Evolve Bank class action says. 

Plaintiffs in all three cases seek to represent nationwide classes of people whose private information was actually or potentially accessed during the data breach. At least five class actions lawsuits have been filed against the bank in relation to the data breach.

The plaintiffs are each suing for negligence, breach of implied contract, breach of fiduciary duty and unjust enrichment. They seek certification of their class actions, damages, fees, costs, a jury trial and injunctions forcing the bank to improve its cyber and data security. 

Last month, a Georgia man sued Truist Bank, saying a cyberattack on the bank’s systems compromised his private information. 

Are you affected by the Evolve Bank data breach? Let us know in the comments! 

The lawyers for the plaintiffs are Table Law PLLC, Ellzey & Associates PLLC, Poynter Law Group, Srourian Law Firm P.C., Milberg Coleman Bryson Grossman PLLC, Clayeo C. Arnold A Professional Corporation and Wucetich & Korovilas LLP.

The Evolve class action lawsuits are Gabriel Stiritz v. Evolve Bank & Trust, Case No. 4:24-cv-00550-JM, in the U.S. District Court for the Eastern District of Arkansas; Natasha Quiates v. Evolve Bank & Trust, Case No. 3:24-cv-00114-KGB, in the U.S. District Court for the Eastern District of Arkansas; and Duncan Meadows v. Evolve Bank & Trust, Case No. 2:24-cv-02450-JPM-tmp, in the U.S. District Court for the Western District of Tennessee. 

Read About More Class Action Lawsuits & Class Action Settlements:

• $31.5M T-Mobile settlement resolves FCC data breach investigations
• Propark class action alleges data breach impacts 20K+ employees
• Snowflake data breach affected Neiman Marcus customers, class action claims
• Avis class action claims data breach exposed data of 300,000 customers