Insider breach at FinWise Bank exposes data of 689,000 AFF customers

An insider breach at FinWise Bank exposed the data of 689,000 American First Finance customers. The incident occurred on 31 May 2024, when FinWise Bank notified the Maine AG that a former employee who had left the organisation continued to access AFF data. Investigators found that the ex-employee maintained access to AFF data after departing, including personal details, though the bank did not disclose technical specifics of the breach.

The disclosure notes that FinWise contracts with AFF to offer instalment loans to consumers, with FinWise acting as the lender and AFF as the technology provider, and the breach may have affected AFF lease-to-own accounts or retail instalment sales agreements linked to those affected. The company is offering 12 months of free credit monitoring and identity theft protection to impacted individuals, and the Maine Attorney General’s data breach notification provides the framing for the incident.

According to Security Affairs, the breach is described as an insider incident tied to AFF data, with investigations supported by external cybersecurity professionals.