On June 25, 2024, Affirm, Inc. posted a notice on its website after discovering that a data breach at Evolve Bank & Trust (“Evolve”) resulted in an unauthorized party being able to access certain confidential information. In this notice, Affirm explains that the incident may have resulted in an unauthorized party being able to access consumers’ sensitive information. Upon completing its investigation, Affirm began sending out data breach notification letters to all individuals whose information was affected by the recent data security incident.

If you received a data breach notification from Affirm, Inc. or Evolve Bank & Trust, it is essential you understand what is at risk and what you can do about it. A data breach lawyer can help you learn more about how to protect yourself from becoming a victim of fraud or identity theft, as well as discuss your legal options following the Evolve / Affirm data breach. For more information, please see our recent piece on the topic here.

What Caused the Data Breach Affecting Affirm Customers?

The Evolve / Affirm data breach was only recently announced, and more information is expected in the near future. However, Affirm and Evolve have both posted website notices providing some important information on what led up to the breach.

According to these sources, Evolve Bank & Trust is the issuing partner for the Affirm Card. Thus, Affirm provides cardholders’ confidential information to Evolve Bank & Trust.

Recently, Evolve learned that a group of hackers claimed to have accessed the company’s IT network, stolen confidential data, and then posted the stolen data on the dark web.

In response, Evolve notified law enforcement and then launched an investigation, which is ongoing. However, at this point in the investigation, Evolve believes that hackers were able to access its network.

After learning that sensitive consumer data was accessible to an unauthorized party, Affirm reviewed the compromised files to determine what information was leaked and which consumers were impacted. While Affirm does not mention what information could have been impacted, in a separate statement, Evolve has indicated that consumers’ names, Social Security numbers, birth dates and financial account information may have been compromised.

The Evolve data breach is still under investigation. However, once the company’s investigation is complete, it will be required to send data breach letters to all affected parties. Affirm may also decide to send letters to those consumers who were affected.

More Information About Affirm, Inc. and Evolve Bank & Trust

Affirm, Inc. is a financial services company based in San Francisco, California. Affirm offers consumers a pay-over-time option, which serves as an alternative to a traditional credit card. Affirm has multiple payment options for everyday purchases and big-ticket items, including monthly installment plans and 4-interest-free payment plans. Affirm employs more than 2,111 people and generates approximately $2.1 billion in annual revenue.

Founded in 1925, Evolve Bank & Trust is a financial institution based in Memphis, Tennessee. In addition to offering personal banking services, Evolve also partners with many large organizations, including Affirm, Airwallex, Alloy, Bond, Branch, Dave, EarnIn, Marqeta, Mastercard, Melio, Mercury, PrizePool, Step, Stripe, TabaPay and Visa. Evolve Bank & Trust employs more than 518 people and generates approximately $308 million in annual revenue.