Truist Bank Confirms Data Breach After Stolen Information Appears Online

The SP1D3R cybercriminal gang is making headlines again, this time by offering sensitive data belonging to thousands of Truist Bank employees for sale.

Truist Bank is a major US commercial bank formed in late 2019 through the merger of SunTrust Banks and BB&T, with $535 billion in assets under management (AUM). The bank provides a broad range of services, from consumer and small-business banking to commercial, corporate and investment banking, as well as insurance, wealth management and payment services.

SP1D3R claims to have stolen information on 65,000 employees, including banking transaction details containing names, account numbers and balances, as well as the source code for IVR-based funds transfers. The asking price is $1 million.

No Connection to Snowflake

The breach apparently took place in October 2023, but Truist only confirmed it after the data was offered for sale.

“In October 2023, we experienced a cybersecurity incident that was quickly contained,” a Truist Bank spokesperson told BleepingComputer. “Working with external security consultants, we conducted a thorough investigation, took additional steps to protect our systems and notified a small number of customers last autumn.”

For those unfamiliar with SP1D3R, the threat actor recently offered sensitive information on 358,000 employees of major US automotive company Advance Auto Parts, along with 380 million customer profiles and a wealth of other information. The asking price was $1.5 million.

SP1D3R has also been observed offering 34 million email addresses and other personally identifiable information (PII) belonging to customers, employees and partners of cybersecurity company Cylance, for $750,000.

Because SP1D3R's breach of Advance Auto Parts involved the data storage provider Snowflake, media reports suggested that the same might have happened here. However, Truist's spokesperson confirmed that the incident was unrelated to Snowflake.

“To be clear, we have found no evidence of a Snowflake-related incident at our company.”