Skip to content
ransomwareSupply Chainvulnerability

LockBit claims US Bank. The breach was four layers deep.

2 min read
Share

LockBit claims US Bank. The breach was four layers deep.

On August 19, 2026, LockBit added US Bank to its data-leak site. The group set a September 3 deadline: pay an undisclosed ransom or the stolen files go public. US Bank's VP of public affairs responded quickly: no indication of internal system compromise, the claimed incident relates to a fourth-party event outside their environment. No samples were posted, no file count given, no affected system described. LockBit 5.0 is running the same playbook it has used since resurfacing after the February 2024 law enforcement takedown.

What fourth-party means in practice

US Bank uses vendors. Those vendors use subcontractors. Those subcontractors use software or services from other providers. That last layer is the fourth party. The bank has almost no visibility into it and often no contractual relationship with it. If LockBit's claim is real, the data did not come from US Bank's systems. It came from somewhere in this chain, and US Bank may not even know which link broke.

Why this matters even if the claim is false

LockBit has posted false or exaggerated claims before, using them to pressure targets who cannot quickly rule out whether their vendor chain was hit. The tactic works because companies genuinely cannot rule out a fourth-party breach on day one. The uncertainty is the weapon. A bank that can confirm its own systems are clean still cannot confirm on day one whether a vendor four hops away was breached.

What the September 3 deadline means for your monitoring

If you work in financial services or serve financial institutions as a vendor: watch the LockBit leak site on September 3. If data is published, the file contents will tell you more about the actual source than any ransomware group's claims will. In the meantime, ask your direct vendors to confirm their own vendor inventory. You may not be able to audit four layers down, but knowing who layer two and layer three are is a start.

Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if you need help mapping your third and fourth-party vendor exposure.

Related articles

Supply Chainopen-source-securityCI/CD

North Korea poisoned the Rust ecosystem. Your build pipeline ran the payload.

On August 20, DPRK-linked attackers compromised a trusted Rust crate maintainer and published three poisoned packages with 245 million downloads. The payload ran during cargo build, before you called a single function.

Critical InfrastructurevulnerabilityCVE

UzCERT: Mass RDP attacks hit Uzbekistan government and private sector

Uzbekistan's Cyber Security Center issued an emergency advisory warning of mass cyberattacks via exposed RDP services. Government bodies and private companies have had data encrypted. Here is what UzCERT reported and what organizations in the region need to do now.

CVEvulnerabilityVulnerability Researchcredential-theft

SharePoint CVE-2026-55040: Forging admin credentials with no password

CVE-2026-55040 lets an unauthenticated attacker forge a valid JWT and impersonate any SharePoint admin with no credentials. Exploitation started hours after a public PoC. If your on-premises SharePoint is internet-facing and unpatched, treat this as an active incident risk.