On 31 August 2026 Jack Henry & Associates, a core banking and payments provider with more than 7,200 clients, said an attacker it identified as ShinyHunters had reached "a limited portion of our internal, non-production corporate environment" through "a sophisticated social engineering attack commonly known as vishing" (Jack Henry). Twelve days later Revolut confirmed it had released customer identity documents to a fraudster using "a legitimate government agency domain email" (TechCrunch). Citizens and Frost blamed a vendor for data the Everest group claimed in April, and by 4 October seven South Korean financial firms had reported breaches.
Quick answer. None of the victims in this record reports that attackers reached core banking. Where the victim has said how the attacker got in, the door was a person on the phone (Jack Henry), a data-request process that trusted a legitimate government email domain (Revolut), a vendor's file-transfer or support platform (Frost's vendor Sefas, EY) or an externally reachable service for loan agents or staff (Shinhan, KB Kookmin). Close them first: call-back rules for data requests and help-desk resets, MFA on vendor accounts, and an inventory of partner portals. Stingrai, a CREST-accredited penetration testing firm, tests those doors with phone-pretext social engineering, assumed-breach scenarios from a vendor account and authenticated portal testing.
Sources are victims' statements and filings, regulators, published research and first-hand reporting; attacker claims are labelled, and counts are as of 13 October 2026.
The incidents, from primary sources
Incident | Statement or notice | Way in, per the source | Exposed |
|---|---|---|---|
Jack Henry | 31 Aug 2026 | Vishing call | PII data for fewer than 10 client institutions |
Revolut | 12 Sep 2026 | Fraudulent requests from a government agency email domain | ID documents, contact details; possibly selfies |
Frost Bank, via Sefas | 22 Apr 2026 | Vendor SFTP server for software support | Tax forms and check images; 200,271 people |
Citizens | 21 Apr 2026 | Data "extracted from a third party vendor" | Mostly masked test data, plus a small number of customers |
Shinhan and six Korean firms | 1 to 4 Oct 2026 | Loan-agent inquiry service, employee mobile system, sales support system | Shinhan: income and loan limits for 25,729 customers |
OneMain Financial | 28 Sep 2026 | Not disclosed | Name, address, Social Security number; 122,783 people |
EY tax services | 13 Jul 2026 | Third-party IT service management platform | Tax data on financial institutions' customers; 10,895 people |
Jack Henry: one call, no payment
Jack Henry says "No client-facing systems, operating systems, core platforms, or daily processing services were accessed or disrupted" and that "personally identifiable information (PII) data for fewer than 10 clients was impacted." It added: "This incident involved an extortion attempt, and we are not making any payment to the threat actor." It calls the incident "not financially material" and has filed no 8-K about it (EDGAR, 13 October 2026).
American Banker reported on 2 September that ShinyHunters had listed Jack Henry on its leak site days earlier, and that Jack Henry had not said what was taken or when. The notice duty sits with the financial institutions: where customer information systems belong to a service provider, "it is the responsibility of the financial institution to notify the institution's customers and regulator" (12 CFR part 30, Appendix B, Supplement A).
Revolut: a real government domain, a fake request
A Revolut spokesperson told TechCrunch: "Revolut recently identified a sophisticated external impersonation scam where an unauthorised third party utilised a legitimate government agency domain email to submit fraudulent requests for information." The customer notice TechCrunch reviewed lists contact details and copies of passports and driver's licences, and says selfies, statements and transaction histories may also have been included. Revolut called the number affected "limited."
Revolut told The Register that "Revolut systems and customer funds are unaffected." People claiming responsibility demanded 10,000 Bitcoin on Telegram; that is their claim, and Revolut did not comment on it.
Domain checks prove where a message came from, not the sender's authority. The FBI warned in November 2024 that criminals send fraudulent emergency data requests from compromised government email addresses, and recommends "contacting the sender and originating authority" (FBI PIN 20241104-001).
Citizens and Frost: one listing, smaller filings
Everest claimed 3.4 million records from Citizens Bank and 250,000 Social Security numbers from Frost Bank after listing both on 20 April (American Banker). The next day Citizens said: "For Citizens, most of this was masked test data, although a limited set of information for a small number of customers was involved," with "no evidence of unauthorized access to the Citizens network." A Frost spokesperson told American Banker that a vendor had reported unauthorized access that "may have included Frost customer data."
The fullest account is the vendor's notice of 20 May, filed under Frost Bank's name with California's attorney general. Sefas Innovation, which provides "document composition software and software development services" to Frost, learned on or about 16 April "that an unauthorized group claimed possession of data". It found "activity consistent with unauthorized access to the SFTP server we use to provide software support" and downloads "intermittently between December 2025 and April 2026, containing Frost Bank data": tax forms and bill-pay check images with Social Security or taxpayer numbers, account and loan numbers and dates of birth. Sefas told Frost on 22 April. Frost's Texas attorney general filing lists 200,271 people, 191,848 of them Texans.
Massachusetts' 2026 breach report lists a Citizens Bank notice of 28 April covering 428 residents, with account data and no Social Security numbers. Customers filed six proposed class actions in April, four against Citizens and two against Frost (American Banker). Neither parent company has filed a cybersecurity 8-K.
South Korea: seven firms in four days
Shinhan Bank confirmed a breach on 30 September and disclosed it on 1 October. Per the Korea Herald, an attacker "bypassed identity verification in a mobile inquiry service loan agents use to check application progress," exposing names, phone numbers, annual income and loan limits for what Shinhan later counted as 25,729 customers (Korea Herald). KB Kookmin reported 119 customers exposed through an employee mobile support system, later reported as 153. Hana Bank said attackers reached a sales support system that "is separate from internet and mobile banking transaction systems." By 4 October seven firms had reported breaches, while Woori Bank and NH NongHyup blocked the attempts (Korea Herald).
On 2 October the Financial Services Commission (FSC) ordered every firm to identify all externally exposed IT assets and services, whether or not they serve customers, and to check for any path to internal information that skips authentication (FSC, in Korean). On 4 October the FSC and the Financial Supervisory Service (FSS) told firms to block in principle all external access that is not indispensable, and to stop personal credit information being stored or viewed unnecessarily in "systems used by external personnel, such as loan solicitors and outsourcing contractors, and by employees, which were the cause of the recent intrusions" (FSC; our translation). The FSS said on 6 October that it had shared 28 distinct attack IP addresses with financial firms (Korea Herald).
No regulator has settled the AI question. The FSC chair said AI use could not be ruled out, and President Lee Jae Myung said on 6 October that "details have emerged of the possible use of artificial intelligence" (Korea Herald). CrowdStrike reported on 7 October that the actor likely used ARTEX, an agentic penetration testing tool, with large language models, and assessed with moderate confidence a financially motivated Chinese speaker, not a named group.
OneMain and EY: notices months later
OneMain Financial's notice of 28 September says it discovered unauthorized activity in May, that personal data was accessed or acquired on 5 May 2026, and that "There was no evidence of any unauthorized access to customer accounts." Texas lists 122,783 people, a 5 to 8 May breach and discovery on 12 May; Oregon lists 5 to 12 May and discovery on 18 August, so the filings disagree. OneMain has not said how the attacker got in.
EY's notice of 13 July says it "provides professional tax services to a wide range of financial institutions globally" and that support tickets on a third-party IT service management platform "may include documents containing client tax information." An unauthorized party downloaded documents from it between 28 March and 12 April 2026.
The pattern: four side doors, none of them the vault
People on the phone. Mandiant described ShinyHunters-branded operations in January 2026 that "primarily leverage sophisticated voice phishing (vishing) and victim-branded credential harvesting sites" (GTIG). In August GTIG reported that a related cluster, UNC6671, "often contacts employees via their personal mobile devices," has, in at least some recent cases, "spoofed the legitimate helpdesk phone number" and by July 2026 had narrowed its targeting to "private equity firms, law firms, and financial rating agencies" (GTIG). See our Scattered Spider account recovery guide, social engineering statistics and vishing statistics.
Processes built to say yes to authority. Revolut has not said whether its requests claimed an emergency; the FBI says criminals "understand the need for exigency, and use it to their advantage."
Vendors and their vendors. Sefas kept tax forms and check images on a support server; EY's support tickets carried tax documents into a third-party platform; Jack Henry is itself a vendor. A bank's use of third parties "does not diminish its responsibility to meet these requirements to the same extent as if its activities were performed by the banking organization in-house" (88 FR 37920).
Portals for partners and staff. Every Korean entry point named so far is a noncore system for loan agents, staff or sales.
Claims are not counts: Everest's 250,000 compares with 200,271 in Frost's filing, and its 3.4 million with Citizens' "small number of customers." Notices lag: OneMain wrote almost five months after the access, EY nearly three months after detecting its incident on 23 April.
What the rules already require
NYDFS. 23 NYCRR 500.11 requires written policies for systems and data "accessible to, or held by, third-party service providers," covering due diligence, "periodic assessment" and their MFA, encryption and incident notice. Since 1 November 2025, 500.12 requires MFA "for any individual accessing any information systems of a covered entity"; 500.14(a)(3) requires annual training "that includes social engineering"; 500.5(a)(1) requires annual penetration testing "from both inside and outside the information systems' boundaries." See our NYDFS requirements guide and, for enforcement, our NYDFS provider guide.
US banking agencies. The 2023 interagency guidance has not been withdrawn: in a notice published on 15 September 2026, the OCC, Federal Reserve, FDIC and NCUA proposed to "rescind and replace" it (91 FR 58536). The 2023 text points due diligence at a vendor's "results of vulnerability and penetration tests" and contracts at a "right to audit." The GLBA security guidelines say tests "should be conducted or reviewed by independent third parties or staff independent of those that develop or maintain the security programs" (12 CFR part 30, Appendix B).
FTC Safeguards Rule. Non-bank financial institutions under 16 CFR 314.4 must use MFA "for any individual accessing any information system," train staff, oversee service providers and, absent continuous monitoring, run annual penetration tests (our FTC guide).
OSFI (Canada). Guideline B-10 says the institution "retains accountability" for outsourced services and for "data to which third-parties have access," subcontractors included. B-13 calls for risk-based MFA, where feasible across external-facing channels for "customers, employees, and third parties" (3.2.7), testing of employees' awareness (3.1.7) and "penetration testing and red teaming" (3.1.2); see our OSFI B-13 guide.
What examiners can ask. These texts and cases invite four questions: which vendors hold customer data and when each was last assessed (500.11(a)(4); 314.4(f)(3)); whether vendor accounts require MFA (500.12; 314.4(c)(5)) and how the help desk verifies a caller before a reset; whether the last penetration test covered vendor access and partner portals (500.5(a)(1)); and when your notification clock started after the vendor's notice (500.17).
When the clock starts after a vendor incident
Regime | Deadline | What starts it |
|---|---|---|
NYDFS 500.17(a)(1) | 72 hours | Determining that an incident occurred "at the covered entity, its affiliates, or a third-party service provider" |
OCC, Fed and FDIC rule (OCC text: 12 CFR 53.3) | 36 hours | Determining that a notification incident, a material disruption, occurred |
NCUA 12 CFR 748.1(c) | 72 hours | Belief of a reportable incident, including data access through "a compromise of a credit union service organization, cloud service provider, or other third-party data hosting provider", or the third party's notice if sooner |
FTC 16 CFR 314.4(j) | 30 days | Discovery of unencrypted customer information acquired without authorization, 500 or more consumers |
OSFI advisory | 24 hours | A reportable incident; OSFI's examples include a breach at a material third party |
The checklist: today, this week, this quarter
# | Action | Owner | Maps to |
|---|---|---|---|
Today | |||
1 | List every vendor that stores, prints or supports customer data, and where copies sit: SFTP drops, tickets, test systems | Third-party risk lead | NYDFS 500.11(a)(1); 16 CFR 314.4(f); CSF ID.AM-04 |
2 | Before answering any government, police or court data request, call back on a number you look up yourself; route it to legal | Legal and fraud lead | FBI PIN 20241104-001; 16 CFR 314.4(c)(1)(i) |
3 | Put help-desk password and MFA resets on a high-assurance script: video check with government ID, manager approval, call back on a known number | Service desk manager | Mandiant guidance; NYDFS 500.12; CSF PR.AA-02 |
4 | Treat any caller claiming to be a vendor as unverified: end the call and contact the account manager on file | Service desk manager | Mandiant guidance; CSF PR.AA-02 |
5 | Find real customer data in test systems and vendor-held test sets, confirm masking, delete what is not needed | Data owner | NYDFS 500.13(b); 16 CFR 314.4(c)(6) |
6 | When a vendor reports an incident, open your own incident record and assess every notification clock that applies the same day | CISO and counsel | NYDFS 500.17(a)(1); CSF GV.SC-08, RS.CO-02 |
This week | |||
7 | Enforce MFA, phishing-resistant where possible, on every vendor, contractor and outsourced developer account; remove shared accounts | Identity lead | NYDFS 500.11(b)(1), 500.12; OSFI B-13 3.2.7; 16 CFR 314.4(c)(5) |
8 | Inventory internet-facing portals for brokers, agents, partners and staff; confirm every page returning customer data requires authentication | Application security lead | FSC directives of 2 October; CSF ID.AM-02 |
9 | Limit what portals and support tools return to the records each role needs; mask national identifiers | Product owners | NYDFS 500.7(a)(1); 16 CFR 314.4(c)(1)(ii) |
10 | Alert on bulk downloads from vendor transfer servers, ticket attachments and test systems | SOC | NYDFS 500.14(a)(1); CSF DE.CM-06 |
11 | Alert on MFA device registrations that follow failed logins, and on SSO from commercial VPN or residential proxy ranges | SOC | GTIG guidance; CSF DE.CM-03 |
12 | Tabletop a fraudulent data request and a vendor extortion claim: who verifies, who decides, who notifies whom | CISO | OSFI B-13 2.7.2; CSF ID.IM-02 |
This quarter | |||
13 | Test the help desk and the data-request team with phone-pretext calls | Security lead | NYDFS 500.14(a)(3); OSFI B-13 3.1.7; CSF PR.AT-01 |
14 | Run an assumed-breach test that starts from a vendor or outsourced developer account | Security lead | NYDFS 500.5(a)(1); OSFI B-13 3.1.2 |
15 | Penetration test broker, partner and staff portals as authenticated users in every role | Application security lead | NYDFS 500.5(a)(1); 16 CFR 314.4(d)(2) |
16 | Contract for audit rights, vendor penetration test results and fast incident notice, subcontractors included | Procurement and counsel | 88 FR 37920; OSFI B-10 2.4.2.2; NYDFS 500.11(b)(3) |
17 | Monitor your external attack surface for new portals, subdomains and services | Security operations | NYDFS 500.5(a)(2), 500.13(a); CSF ID.AM-02 |
18 | Map each critical vendor's own vendors: support platforms, print and mail, tax and document services | Third-party risk lead | OSFI B-10 Principle 5; CSF GV.SC-07 |
Where Stingrai fits
Stingrai is a global CREST-accredited penetration testing services company founded in Toronto, Canada in 2021, trusted by companies from startups to enterprises to meet audit requirements for SOC 2, ISO 27001, CMMC, PCI DSS and HIPAA. OSCE³, OSWE, OSEP, CREST CRT certified pentesters, who are also world-class security researchers and bug bounty hunters. Choose from fully human-led or hybrid (AI agents plus human penetration testers) engagements across web, API, mobile, AI and LLM, cloud, network, Active Directory and social engineering penetration tests and red team engagements.
For financial firms and their vendors, the work is human-led, by two named penetration testers from a team holding OSCE³, OSWE, OSEP, CREST CRT and CISSP certifications, with 18 published CVEs across the team.
Social engineering and phishing campaigns: social engineering engagements combine phone pretext, targeted email and in-person scenarios, scoped for example to your help desk and data-request team, and phishing campaigns include MFA-bypass scenarios.
Assumed breach and red team scoped to vendor access: an adversary simulation or red team that starts from the stolen credentials of a vendor, contractor or outsourced developer and measures what they reach.
Web application testing of broker and partner portals: authenticated testing across every user role, including support consoles and their APIs, for authentication bypass, broken authorization and business logic flaws.
Whether the engagement is a one-time annual test or a continuous program, every confirmed finding, at every severity, is posted to the PTaaS platform the same day it is confirmed, retesting is included, and every human-led and hybrid report ships with an attestation letter: pentest evidence for your NYDFS, FFIEC and OSFI B-13 programs. This work is scoped per engagement; Stingrai's published fixed prices cover one web application and associated APIs only (pricing). Hit already? See the first 48 hours after an incident.
Frequently Asked Questions
What were the biggest financial services cyberattacks of 2026?
Among the incidents covered here, the largest disclosed counts are Frost Bank's vendor breach at Sefas Innovation (200,271 people), OneMain Financial (122,783) and seven South Korean firms led by Yegaram Savings Bank (about 40,000) and Shinhan Bank (25,729). Jack Henry reported PII exposure at fewer than 10 client institutions. None reports access to core banking.
How did attackers breach Jack Henry in 2026?
Jack Henry says the incident "began with a sophisticated social engineering attack commonly known as vishing (voice phishing) initiated by a threat actor identified as ShinyHunters" and reached a non-production corporate environment, not core platforms. It refused to pay the extortion demand.
What happened in the Revolut data breach?
Revolut confirmed on 12 September 2026 that "an unauthorised third party utilised a legitimate government agency domain email to submit fraudulent requests for information," affecting a "limited" number of customers whose data included identity documents.
Were Citizens Bank and Frost Bank hacked?
Both banks report no evidence of access to their own networks and blame a vendor. Everest claimed 3.4 million Citizens records and 250,000 Frost Social Security numbers; Citizens says most of its data was masked test data, and Frost's Texas filing lists 200,271 people.
What happened to South Korean banks in October 2026?
Shinhan Bank disclosed a breach through a loan-agent inquiry service on 1 October, and by 4 October seven financial firms had reported breaches. The FSC ordered firms to inventory every externally exposed system and check for any path to data that skips authentication.
Does a vendor's breach start my notification clock?
Often. NYDFS 500.17 counts 72 hours from determining that an incident occurred at the covered entity, an affiliate or a third-party service provider; NCUA counts 72 hours from a third party's notice where that comes first.
How do you stop vishing attacks on a bank help desk?
Follow Mandiant's January 2026 guidance: a live video check with government ID for password and MFA resets, approval from the user's known manager, a call back on a known good number, and no resets on employee ID, SSN or manager name alone. Then test the script with phone-pretext calls.
Related reading
Scattered Spider Identity Takeover: Account Recovery Red Teaming
Best Banking and Credit Union Penetration Testing Companies (2026)
References
Jack Henry & Associates. Jack Henry Issues Statement on Response to Cybersecurity Incident. 31 August 2026. https://ir.jackhenry.com/node/25421
American Banker. Jack Henry refuses to pay extortionists after data theft. 2 September 2026. https://www.americanbanker.com/news/jack-henry-refuses-to-pay-extortionists-after-data-theft
TechCrunch. Revolut confirms customer data breach through fake government requests. 12 September 2026. https://techcrunch.com/2026/09/12/revolut-confirms-customer-data-breach-through-fake-government-requests/
The Register. Revolut falls for fake government requests, hands over customer data. 14 September 2026. https://www.theregister.com/cyber-crime/2026/09/14/revolut-falls-for-fake-government-requests-hands-over-customer-data/5296118
FBI. Private Industry Notification 20241104-001. 4 November 2024. https://www.ic3.gov/CSA/2024/241104.pdf
Citizens Financial Group. Citizens Offers Statement Regarding Third-Party Vendor Event. 21 April 2026. https://investor.citizensbank.com/about-us/newsroom/latest-news/2026/2026-04-21.aspx
American Banker. Citizens, Frost blame vendor after data breach claim (22 April 2026) and Customers sue Citizens, Frost over third-party data breach (29 April 2026). https://www.americanbanker.com/news/citizens-frost-blame-vendor-after-data-breach-claim, https://www.americanbanker.com/news/customers-sue-citizens-frost-over-third-party-data-breach
Sefas Innovation for Frost Bank. Notice of Data Security Incident, California Attorney General. 20 May 2026. https://oag.ca.gov/ecrime/databreach/reports/sb24-623688
Texas Attorney General. Data Security Breach Reports. https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage
OneMain Financial Group. Notice of Data Breach, California Attorney General. 28 September 2026. https://oag.ca.gov/ecrime/databreach/reports/sb24-630345
Oregon Department of Justice. Data breach database. https://justice.oregon.gov/consumer/DataBreach/
Ernst & Young LLP. Notice of Data Breach, California Attorney General. 13 July 2026. https://oag.ca.gov/ecrime/databreach/reports/sb24-626542
The Korea Herald. Reports of 2, 5 and 6 October 2026. https://www.koreaherald.com/article/10892290, https://www.koreaherald.com/article/10893326, https://www.koreaherald.com/article/10894542, https://www.koreaherald.com/article/10894156
Financial Services Commission. Press releases of 2 and 4 October 2026 (in Korean). https://www.fsc.go.kr/no010101/87869, https://www.fsc.go.kr/no010101/87876
CrowdStrike. Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance. 7 October 2026. https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/
Mandiant and GTIG. Tracking the Expansion of ShinyHunters-Branded SaaS Data Theft and Proactive Defense Against ShinyHunters-Branded Data Theft Targeting SaaS. 30 January 2026. https://cloud.google.com/blog/topics/threat-intelligence/expansion-shinyhunters-saas-data-theft, https://cloud.google.com/blog/topics/threat-intelligence/defense-against-shinyhunters-cybercrime-saas
GTIG. UNC6671 Rebrands: Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments. 6 August 2026. https://cloud.google.com/blog/topics/threat-intelligence/unc6671-targets-financial-services-and-enterprise-cloud-environments
NYDFS. Second Amendment to 23 NYCRR 500. https://www.dfs.ny.gov/system/files/documents/2023/10/rf_fs_2amend23NYCRR500_text_20231101.pdf
Federal Reserve, FDIC and OCC. Interagency Guidance on Third-Party Relationships: Risk Management, 88 FR 37920. 9 June 2023. https://www.federalregister.gov/documents/2023/06/09/2023-12340/interagency-guidance-on-third-party-relationships-risk-management
OCC, Federal Reserve, FDIC and NCUA. Proposed Third-Party Risk Management Guidance, 91 FR 58536. 15 September 2026. https://www.federalregister.gov/documents/2026/09/15/2026-18859/proposed-third-party-risk-management-guidance
eCFR. 12 CFR part 30 Appendix B; 12 CFR 53.3; 12 CFR 748.1; 16 CFR 314.4. https://www.ecfr.gov/current/title-16/part-314/section-314.4
OSFI. Guideline B-10 and Guideline B-13. https://www.osfi-bsif.gc.ca/en/guidance/guidance-library/third-party-risk-management-guideline, https://www.osfi-bsif.gc.ca/en/guidance/guidance-library/technology-cyber-risk-management
OSFI. Technology and Cyber Security Incident Reporting Advisory. 13 August 2021. https://www.osfi-bsif.gc.ca/en/guidance/guidance-library/technology-cyber-security-incident-reporting
NIST. Cybersecurity Framework 2.0, CSWP 29. 26 February 2024. https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf
Massachusetts OCABR. 2026 Data Breach Notification Report (entry 2026-655). https://www.mass.gov/doc/data-breach-report-2026/download
Talk to Stingrai
Would your help desk, vendor access and partner portals have held? Stingrai scopes phone-pretext social engineering, assumed-breach tests from a vendor account and authenticated portal testing, as a one-time annual engagement or a continuous program. Get a quote.
