Webster Bank customer data exposed in Guardian Analytics vendor breach

Webster Bank notified regulators and customers in April 2023 that personal information had been exposed through a breach at Guardian Analytics, a third party provider of fraud monitoring services used by the bank.

The bank said unauthorised parties accessed Guardian Analytics systems between 27 November 2022 and 22 January 2023, and that Webster learned of the incident on 26 January 2023. Webster said its own systems had not been compromised.

In its filing with Connecticut regulators the bank reported 153,754 affected Connecticut customers. Of those, 117,278 had a name and account number exposed, while 36,476 had a name, account number and Social Security number exposed. Webster offered 24 months of credit monitoring, as Connecticut law requires when Social Security numbers are involved.

The incident led to litigation and regulatory action. In October 2024 the Connecticut Attorney General announced a 500,000 dollar settlement with Guardian Analytics and its successor Actimize, which acquired the firm in 2020. The Attorney General's office said two unauthorised actors accessed names, account numbers, transaction details and Social Security numbers belonging to 157,629 Connecticut residents who were Webster Bank customers, a higher count than the figure in the 2023 notification.

The settlement required the companies to maintain a comprehensive information security programme, encrypt personal data, apply multi-factor authentication, run annual risk assessments, maintain incident response plans and submit to third party security audits.