The financial sector holds the most sensitive data in the economy and handles the largest wire transfers on earth. It’s also where the most consequential cyberattacks play out. Six incidents over sixteen years tell the story of an industry learning, repeatedly, that security failures have compounding consequences: regulatory fines, class-action litigation, and erosion of customer trust that takes decades to rebuild.

1. Heartland Payment Systems (2008)

In January 2009, Heartland Payment Systems disclosed that intruders had breached its payment processing network and stolen data from approximately 130 million credit and debit card accounts—the largest breach in history at that point. The attackers used SQL injection to implant memory-parsing malware on Heartland’s systems, capturing account data as it moved through the network in real time.

The breach didn’t just expose cards. It exposed a fundamental gap: card data was flowing unencrypted through Heartland’s processing infrastructure in readable form. The Payment Card Industry Data Security Standard (PCI DSS) had existed since 2004, but compliance was often treated as a checkbox, not a security posture.

Heartland ultimately paid $145 million to settle card brand fines and litigation. The breach accelerated the migration to end-to-end encryption and tokenization, fundamentally changing how payment data is handled across the entire payment ecosystem. Visa and Mastercard raised their compliance requirements and created the Payment Card Industry Security Standards Council.

What training would have prevented this: SQL injection defense, secure coding practices, and understanding of PCI DSS requirements at the developer and sysadmin level. PCI DSS compliance training addresses the root failure mode.

Quick Test

Could your team pass a phishing simulation?

Most SMB teams don't know how bad their phishing exposure is until an attack succeeds. Take 3 minutes to get a real-world baseline of your team's detection ability.

Take the 60-Second Phishing IQ Quiz →

2. First American Financial (2019)

In May 2019, a security researcher discovered that First American Financial’s website was exposing approximately 885 million documents related to real estate transactions—including bank statements, tax records, Social Security numbers, wire transfer instructions, and mortgage paperwork. No authentication was required to access these records; the vulnerability was a broken access control (IDOR — Insecure Direct Object Reference) in the URL structure.

Anyone who knew a document number could access any other document on the system. The researcher reported the issue to First American twice before going public; First American initially dismissed it, triggering regulatory scrutiny and a class-action lawsuit.

The breach demonstrated that data exposure isn’t always about stolen credentials or sophisticated attacks—sometimes it’s a broken access control on a public-facing application. The New York Department of Financial Services (NYDFS) fined First American $1 million for failures in their cybersecurity program.

What training would have prevented this: Secure web application development, authentication and authorization testing, and understanding of regulatory requirements for financial services data. Financial services security training covers the regulatory and technical requirements that First American failed to meet.

3. Capital One (2019)

In July 2019, Capital One disclosed that a misconfigured web application firewall allowed an attacker to exploit a Server-Side Request Forgery (SSRF) vulnerability to access customer data stored in AWS. The attacker — Paige Thompson, a former AWS employee — used the access to exfiltrate data from approximately 100 million U.S. customers and 6 million Canadian customers, including names, addresses, credit scores, Social Security numbers, and bank account numbers.

The total cost to Capital One: $300 million in regulatory fines and customer remediation. Thompson was eventually convicted of computer fraud.

What made the Capital One breach historically significant was its scale and the fact that the attack vector — SSRF against a WAF misconfiguration in a cloud environment — was replicable across any organization using similar infrastructure patterns. The breach became a landmark case study for cloud security architecture and the shared responsibility model.

What training would have prevented this: Cloud security fundamentals, SSRF defense, proper configuration of web application firewalls, and understanding of the shared responsibility model. BEC and wire fraud training covers the financial manipulation tactics that often follow credential theft from breaches like this.

4. Flagstar Bank (2022)

In June 2022, Flagstar Bank disclosed that a January 2022 breach had exposed the personal information of approximately 1.5 million individuals. The bank initially discovered the breach in early 2022 but did not notify affected individuals until June — a five-month delay that drew criticism from state attorneys general and triggered investigations by the New York Department of Financial Services (NYDFS).

The exposed data included Social Security numbers, names, addresses, dates of birth, and in some cases Tax IDs. Flagstar faced multiple class-action lawsuits and NYDFS enforcement action for the delayed notification.

What makes the Flagstar breach important is not the breach itself — these happen constantly — but the notification failure. Financial institutions are subject to strict notification requirements under state law and NYDFS regulations. The gap between discovery and disclosure created additional regulatory exposure beyond the breach itself.

What training would have prevented this: Incident response procedures, regulatory notification requirements, and cybersecurity governance. Community banks and credit unions can use the SecurEveryone financial services training program to prepare their teams for incident response and compliance requirements.

Quick Test

Could your team pass a phishing simulation?

Most SMB teams don't know how bad their phishing exposure is until an attack succeeds. Take 3 minutes to get a real-world baseline of your team's detection ability.

Take the 60-Second Phishing IQ Quiz →

5. Industrial and Commercial Bank of China (ICBC) — November 2023

In November 2023, Industrial and Commercial Bank of China (ICBC)’s U.S. branch was hit by a ransomware attack that disrupted Treasury market trading and left the bank unable to settle trades directly for several days. ICBC — the world’s largest bank by assets — had to resort to manual processing and enlisted BNY Mellon as a temporary intermediary to continue clearing Treasury transactions.

The attack was attributed to LockBit ransomware operators. The breach was notable precisely because of its target: the largest bank in the world, with significant systemic importance to global financial markets. The attack demonstrated that ransomware operators were willing to target systemic financial infrastructure — and that even institutions with substantial security budgets could be disrupted.

ICBC reportedly paid a ransom to recover its systems. The incident prompted emergency communications from U.S. financial regulators and highlighted the need for robust incident response and business continuity planning at financial institutions of all sizes.

What training would have prevented this: Ransomware awareness, executive-level incident response planning, and business continuity procedures. Download the Ransomware Response Playbook — a 12-page guide covering exactly what organizations need to do in the first 60 minutes after an attack.

6. Evolve Bank & Trust / Affirm/Wise/Mercury Breach (2024)

In July 2024, Evolve Bank & Trust disclosed that a data breach had exposed personal information of approximately 7.6 million individuals. The breach was discovered after the LockBit ransomware group published stolen data; Evolve had been aware of unauthorized access since May 2024 but had not completed its notification process when the data was published.

Evolve Bank & Trust is a core banking-as-a-service provider that powers fintech products for companies including Affirm (buy-now-pay-later), Wise (international transfers), and Mercury (business banking). The breach cascaded to millions of end users of these platforms who had never directly interacted with Evolve, illustrating the systemic risk embedded in the BaaS model.

The breach triggered regulatory action: the Federal Reserve issued a rare enforcement action against Evolve, and the bank entered a consent order requiring it to improve its cybersecurity program. FinCEN flagged the incident as a money laundering risk given the bank’s role in fintech onboarding. SOC 2 compliance training is directly relevant here: the audit failures that allowed Evolve’s security gaps to persist undetected are exactly what SOC 2 assessments are designed to catch.

What training would have prevented this: Vendor risk management, third-party security awareness, and SOC 2 control understanding. Download the free IR Plan Template to ensure your organization has a documented response plan for when third-party breaches affect your customers.

What These Six Incidents Tell Us

Six breaches, sixteen years, three continents, and trillions in market cap impacted. The patterns are consistent:

The common thread: in each case, a combination of human error, inadequate training, and governance gaps created the condition for the breach. No amount of technology fully replaces a team that understands the threat landscape.

Training That Addresses Financial Sector Attack Patterns

SecurEveryone’s financial services training covers the specific failure modes documented in these incidents:

Community banks, credit unions, fintechs, and regional financial institutions all face the same threat landscape. Book a session with SecurEveryone and start with a tabletop exercise based on real breach scenarios.

Sources: U.S. Secret Service / DOJ (Heartland), Krebs on Security (First American), DOJ Indictment (Capital One), NYDFS (Flagstar), Reuters / Federal Reserve (ICBC, Evolve Bank). IBM/Ponemon Cost of a Data Breach 2024. Verizon DBIR 2024. FinCEN SAR Activity Review May 2025.