US Bank probes LockBit's breach claim as ransomware gang sets leak deadline

US Bank announced that it is investigating claims made by the LockBit ransomware group that it breached the bank’s systems and exfiltrated data, threatening to release the information on September 3 unless a ransom is paid. Lee Henderson, the bank’s vice president of public affairs, acknowledged awareness of the allegations but refused to answer questions about the ransom amount or any direct contact with the criminals.

LockBit added the bank to its public leak platform on Wednesday night, imposing a 14-day deadline for payment. Historical evidence from a 2024 takedown of an earlier LockBit operation indicated the gang often keeps victim data even after ransoms are paid. The group resurfaced in September 2025 with a new LockBit 5.0 ransomware strain. The current claim follows earlier third-party breaches that led US Bank to alert 537 Massachusetts customers about compromised credit-card numbers, though Social Security numbers and account balances remained untouched.