Santander US reveals employee bank account details stolen

Thousands of Santander’s US-based employees had their bank account information stolen in the recent data breach.

The Spain-based banking giant started sending breach notification letters to its US staff, informing them that some of them had their personal details stolen in the May data breach. According to information the bank submitted to the Maine Attorney General, 12,786 people were impacted by the attack.

“On May 10, 2024, Santander learned that an unauthorized party obtained certain records from a third-party database used by one of the Company’s affiliates between late,” reads the breach notification letter.

Santander said that the stolen data “may have included” employee names, Social Security numbers, and bank account information used for direct deposit or payroll.

The breach notification has also revealed how long the attackers roamed the database with Santander’s data. The company reported to the Maine Attorney General that the data breach occurred on April 17 and wasn’t discovered until May 10.

In mid-May, the bank publicly acknowledged it was the victim of a cyberattack on the database hosted by a third-party provider. A couple of weeks later, ShinyHunters, a notorious threat actor, posted data for sale on an illicit marketplace. The breach allegedly affected 30 million customers from Spain, Chile, and Uruguay.

Santander was among the first victims in the chain of attacks that impacted clients of the cloud service provider Snowflake. The Ticketmaster data breach, which exposed 560 million of the company’s customers, likely happened after attackers accessed its Snowflake account. The company confirmed that attackers accessed its “third-party cloud database environment.”

Last week, malicious actors said they had stolen three terabytes of data from Advance Auto Parts, a US-based automotive parts behemoth, via the company’s Snowflake account. The company has confirmed it suffered a data breach.

Santander is among the world’s largest financial institutions, reportedly accumulating a revenue exceeding €57 billion ($60 billion) in 2023. The bank employs over 210,000 staff worldwide.