The Company That Runs Your Bank Just Got Hit by Ransomware

Close-up of a payment terminal with a credit card being inserted — Photo via Unsplash

TL;DR: The Everest ransomware group listed Fiserv on its Tor leak site on May 3, 2026, with a 3-4 day countdown before publishing stolen data. That window is closing right now. Fiserv is a $90 billion financial technology company based in Wisconsin that processes payments, runs online banking platforms, and manages debit-card networks for thousands of banks and credit unions across the United States. Initial threat intelligence assessments show 1,064 compromised user credentials and 170 third-party credentials. Fiserv has not confirmed or denied the breach. If you bank at a community bank or credit union, there is a real chance Fiserv handles your transactions, and you have never heard of them.

What Is Fiserv and Why Should You Care

You probably bank at Bank of America, or Chase, or your local credit union. But behind the logo on the app, there is a decent chance that Fiserv is the company actually running the plumbing.

Fiserv is one of the three largest financial technology providers in the United States. The company handles:

Payment processing: debit card transactions, ACH transfers, and merchant services for banks of all sizes
Core banking platforms: the actual software that community banks and credit unions use to manage accounts, loans, and deposits
Online and mobile banking: the digital banking interface millions of Americans log into every day
Bill pay and money movement: the infrastructure that moves money between accounts and institutions

Fiserv's client list includes Bank of America, PNC, Santander, Citi, and hundreds of regional and community banks ^[1]. The company reported $20.1 billion in revenue in 2025. It is a Fortune 500 company with a market cap around $90 billion.

When you swipe your debit card at a gas station, the odds are not trivial that Fiserv's network authorizes the transaction. When your credit union's app loads your balance, Fiserv's platform may be serving the data. This is financial infrastructure: invisible until it breaks.

The Everest Listing

On May 3, 2026, the Everest ransomware group added Fiserv to its Tor-based leak site with a countdown timer, the group's standard double-extortion tactic ^[2][3]. The threat: pay up or the stolen data goes public within 3-4 days.

That countdown puts the leak window at today, May 6, through May 7.

The initial assessment from threat intelligence platforms shows ^[4][5]:

4 compromised employee accounts
1,064 compromised user credentials
170 third-party employee credentials
104 external attack surface exposures

The leak size is listed as "unknown," which could mean Everest has not disclosed the volume, or the data is still being sorted. Everest's typical approach is to steal data without encrypting systems, then threaten to publish or sell it ^[6].

Who Is Everest

Everest is a Russian-speaking, financially motivated group that has been active since late 2020. They are not the biggest ransomware operation, but they have a track record that proves they hit hard targets and follow through on threats ^[6]:

AT&T: 576,000 applicant records exfiltrated (October 2025)
Dublin Airport: 1.5 million passenger files stolen (October 2025)
Svenska kraftnät: 280 GB of data stolen from Sweden's national power grid operator
Collins Aerospace: an attack that disrupted operations at European airports including Heathrow and Brussels

September through October 2025 was Everest's most active period, hitting critical infrastructure across multiple countries. The Fiserv listing signals they are back after a quieter winter.

Everest operates a hybrid model. When victims refuse to pay, the group does not just leak. It also sells network access to other threat actors ^[6]. That means even if Fiserv's data is not dumped publicly, access to Fiserv's systems could end up on the market for a second, more capable attacker.

Why Financial Infrastructure Breaches Are Different

When a retailer gets breached, your credit card number leaks. Your bank sends you a new card. Annoying, recoverable.

When the company that processes the credit card transactions gets breached, the blast radius is different. A Fiserv compromise could expose:

Transaction records: who spent what, where, and when, across thousands of institutions
Account data: balances, account numbers, routing information from banks that use Fiserv's core platform
Authentication credentials: the 1,064 user credentials already identified suggest system-level access, not customer-facing logins
Third-party access: 170 vendor credentials means the breach could cascade into other financial technology providers

Fiserv has been breached before. In January 2024, the company disclosed that a MOVEit file transfer vulnerability exposed customer data. That breach was a supply-chain hit: a third-party tool compromise, not a direct attack. This time, Everest is claiming credit for a direct breach.

Fiserv's Silence

As of May 6, Fiserv has not confirmed, denied, or acknowledged the Everest listing in any public statement. No SEC filing. No customer notification. No press release ^[2][4].

Under the SEC's 2023 cybersecurity disclosure rules, public companies must report material cybersecurity incidents within four business days of determining the incident is material. The clock on that determination may or may not have started. Fiserv could argue it is still assessing materiality.

But the customers, the banks and credit unions that rely on Fiserv's platform, are operating blind right now. A community bank in Ohio whose core banking system runs on Fiserv has no public information to assess whether its data, or its customers' data, is in the Everest listing.

What You Should Do

You probably cannot tell if Fiserv handles your bank's backend. Banks do not advertise their technology vendors to customers. If you bank at a community bank, credit union, or regional institution, there is a meaningful probability that Fiserv is involved. But you will not find that on your bank's website.
Monitor your bank accounts closely for the next 30 days. Watch for unauthorized transactions, especially small test charges (fraudsters often run a $1-3 charge before a larger withdrawal).
Set up transaction alerts. Most banking apps let you get a push notification for every debit over a threshold. Set it to $1 or $0 if your bank allows it.
Pull your free credit report. AnnualCreditReport.com offers free weekly reports from all three bureaus. Check for accounts or inquiries you do not recognize.
Watch for phishing. If stolen data includes bank customer information, expect targeted phishing emails that look like they come from your bank. Log in through your bank's app or website directly. Never click a link in an email or text.

What to Watch Next

May 6-7: The Everest leak deadline window. If the listing flips to "leaked," researchers will start analyzing the dump within hours.
Next 4 business days: The SEC materiality determination clock. If Fiserv determines this is material, expect an 8-K filing.
Next 30 days: State regulators. Banking regulators in all 50 states have jurisdiction over financial institutions that use Fiserv. The OCC, FDIC, and state banking departments will want answers.
Downstream notifications: If Fiserv confirms a breach, every bank and credit union that uses affected Fiserv services will need to assess whether customer data was exposed, and notify accordingly.

The uncomfortable truth about financial infrastructure is that security depends on companies most people have never heard of. Fiserv, FIS, Jack Henry: these are the names behind your bank's name. When one of them gets hit, the blast radius is not one company. It is the banking system itself.

Sources

Published: May 6, 2026