Frost Bank Listed by everest Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
Frost Bank has been listed by the everest ransomware group, with internal files reported as exfiltrated in the attack. The incident was disclosed on April 20, 2026, and an undisclosed number of people may be affected; anyone connected to the bank should check for notices and monitor their accounts.
What happened
The incident was reported on April 20, 2026, when Everest added Frost Bank to its public leak site. The group claims that files were taken from the bank during a ransomware operation. No information has been made public about the number of records involved, the precise date of the intrusion, or the method used to gain access. Frost Bank has not issued a separate statement confirming or disputing the listing.
Inside everest
Everest is a ransomware group that follows the double-extortion model common among current threat actors. It typically encrypts systems to disrupt operations and then removes data for later publication if a ransom demand is not met. The group maintains a leak site where it lists victims and, in some cases, posts samples of stolen material. Everest has appeared in public reporting since at least 2022 and has targeted organisations in multiple countries and industries.
Frost Bank and its sector
Frost Bank is a Texas-based financial institution and a subsidiary of Cullen/Frost Bankers, Inc. Founded in 1868 and headquartered in San Antonio, it provides personal and commercial banking, wealth management, insurance, and investment services across major Texas cities. As one of the larger independent banks in the state, it holds customer accounts, transaction records, and other records typical of a full-service financial institution operating in the United States.
What was likely exposed
The only detail released is that internal files were allegedly exfiltrated. The exact categories of data contained in those files have not been disclosed. Financial institutions routinely store customer identification details, account numbers, transaction histories, and internal operational documents, but it is not confirmed whether any of these specific types appear in the material allegedly taken from Frost Bank.
Why it matters
When internal files from a bank are removed, the primary concern is the potential use of that information for fraud, identity theft, or further targeting of customers and the institution itself. Because the volume and nature of the data remain unknown, affected individuals cannot yet assess their personal exposure. For the bank, the incident adds to the operational and regulatory burdens that follow any confirmed data exfiltration in the financial sector.
Were you affected?
Customers of Frost Bank should monitor their accounts for unusual activity and review any official notices the bank may issue. Individuals can also take the following steps while more information remains unavailable:
- Enable transaction alerts on existing accounts.
- Request credit reports from the major bureaus to check for unauthorised activity.
- Run a free exposure scan of their email address against known breach data.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
Fiserv Listed by everest Ransomware GroupTSYS Listed by everest Ransomware GroupLiberty Mutual Insurance Listed by everest Ransomware GroupCitizens Bank Listed by everest Ransomware GroupLatest breaches
Read GalaxyWarden’s full analysis of the Frost Bank Listed by everest Ransomware Group →
Publicly posted by everest — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.