US Bank is investigating claims by the ransomware group LockBit that it breached its systems and stole data. The group has set a September 3 deadline to receive a ransom payment or publish the data.

LockBit is a ransomware group that faced law enforcement actions in 2024 and 2025, when its servers and infrastructure were seized and its leader’s identity was disclosed, though the suspect remains at large. The group has previously threatened to release stolen data unless victims pay.

US Bank said it has no evidence that its internal systems were compromised and has not confirmed communication with the extortionists. A spokesperson declined to disclose the ransom demand amount or whether the bank has engaged with the criminals. The group posted the bank on its leak site on Wednesday night and gave the bank 14 days to pay. The alleged breach was first detected on May 7, when the bank learned of a third‑party security incident involving its vendor Fidelity National Information Services. In June the bank notified 537 Massachusetts customers that their names, mailing addresses, and credit card numbers may have been exposed. A separate incident in 2022 affected about 11,000 customers after a vendor inadvertently shared a file containing personal information from closed credit card accounts.

US Bank continues to monitor the situation and says no systems are currently impacted. A law firm is considering a class‑action lawsuit on behalf of customers whose credit card data may have been exposed. The deadline approaches with the outcome still uncertain.