FinWise breach found year late - lawsuits surge
FinWise Bank disclosed that personal information for roughly 689,000 customers may have been exposed in a cybersecurity incident first detected more than a year after it occurred.
According to a notice published by the Maine attorney general’s office on Sept. 12, a former FinWise employee accessed names, dates of birth, Social Security numbers and account numbers on May 31, 2024. The bank said it did not learn of the breach until June 18, 2025.
FinWise notified affected customers on July 29. Within days, multiple lawsuits were filed against the bank and its fintech partner, American First Finance, and six class actions have since been consolidated in federal court in Utah.
At least one complaint contends that FinWise stored data unencrypted and “negligently and unlawfully failed to safeguard” it.
Plaintiffs also accuse the companies of breach of contract and unjust enrichment and are seeking a court order requiring stronger protections, including encryption of all data collected in the course of business.
In letters to customers, FinWise said that once the breach was discovered it immediately launched an investigation with external cybersecurity specialists to determine whether sensitive data had been accessed.
The bank is offering 12 months of free credit monitoring and identity theft protection to those affected.
Some plaintiffs argue that a year of services is inadequate given the exposure of Social Security numbers and are pushing for lifetime monitoring and protection.
The consolidated complaint seeks more than $5 million in relief, without specifying how much would be allocated to damages.
FinWise warned investors in an August quarterly filing that additional lawsuits may follow. The bank said it intends to defend the litigation vigorously and, while unable to estimate potential losses or damages, expects the impact will not be material.
A FinWise spokesperson did not immediately respond to a request for comment. American First Finance, which partners with FinWise to offer installment loans, was also named in the litigation. Under their arrangement, FinWise acts as lender while the fintech provides technology.
FinWise told customers that “some” of the impacted data is connected to American First Finance.
The cases are likely to scrutinize partner oversight, third-party controls and incident detection capabilities, given the lengthy gap between the initial access and the bank’s discovery of the breach.
Regulatory attention may also intensify as plaintiffs highlight allegations of weak controls and delayed detection, while the companies point to their post-discovery investigation and remediation steps.
For customers, the immediate questions center on credit monitoring, identity protection and how long the fallout could last.