On July 14, 2023, Sunflower Bank filed a notice of data breach with the Securities and Exchange Commission after discovering that MOVEit, a file transfer program used by the bank, contained a critical vulnerability allowing hackers to access confidential customer information. Sunflower Bank is still in the process of investigating the incident; however, if it confirms that customer or employee information was leaked as a result of the MOVEit incident, the company indicates that it will send out data breach notification letters to all affected individuals.

If you receive a data breach notification from Sunflower Bank, it is essential you understand what is at risk and what you can do about it. While the recent MOVEit incident did not involve Sunflower Bank’s computer system, the bank used MOVEit to transfer confidential data. As a result, customers who provided their information to Sunflower may be affected. A data breach lawyer can help you learn more about how to protect yourself from becoming a victim of fraud or identity theft as well as discuss your legal options following the Sunflower Bank data breach. For more information, please see our recent piece on the topic here.

What Caused the Data Breach Affecting Sunflower Bank?

The data breach impacting Sunflower Bank customers was only recently announced, and more information is expected in the near future. However, Sunflower Bank’s filing with the Securities and Exchange Commission provides some important information on what led up to the breach. Sunflower Bank also posted a “Notice of Third-Party MOVEit Data Breach” on its website.

According to these sources, Sunflower Bank uses a file transfer program called MOVEit to securely transfer sensitive and confidential information, including for its First National 1870 and Guardian Mortgage divisions.

Around May 31, 2023, Progress Software, the developer of MOVEit, informed Sunflower Bank that MOVEit contained a critical vulnerability. Based on other reports, this vulnerability allows hackers to access information stored within the program.

Once Sunflower Bank learned of the MOVEit vulnerability, the bank secured its computer systems, installed all patches to eliminate the MOVEit vulnerability, and launched an investigation with the help of a third-party forensics firm. Based on this investigation, Sunflower Bank believes that an unauthorized party was able to download files from its MOVEit server before the bank was notified of the vulnerability.

Currently, Sunflower Bank is continuing with its investigation and reviewing all files that were potentially impacted.

If and when Sunflower Bank confirms that customer or employee data was compromised, it will send out data breach letters to all affected parties. These letters should provide victims with a list of what information of theirs was compromised.

Notably, the Sunflower Bank / MOVEit data breach did not involve hackers gaining access to Sunflower Bank’s system, as only information stored on the bank’s MOVEit server was compromised.

More Information About Sunflower Bank

Founded in 1892, Sunflower Bank is a financial institution based in Denver, Colorado. Sunflower Bank operates dozens of branches in Colorado, New Mexico, Kansas, Texas, and Arizona and offers mortgages to customers in 43 states. Sunflower Bank is a wholly-owned subsidiary of FirstSun Capital Bancorp. Sunflower Bank employs more than 1,155 people and generates approximately $286 million in annual revenue.