Frost Bank has notified customers that their personal information may have been exposed after a security incident at Sefas Innovation, Inc., a third-party vendor that provides document processing and software support services to the bank. The incident did not originate within Frost Bank’s own network, but the vendor relationship gave the company access to customer records that were ultimately compromised.
Companies that entrust sensitive customer data to outside vendors have a responsibility to ensure those vendors maintain adequate security safeguards, and a breach at a vendor can carry the same real-world consequences for consumers as a breach at the bank itself.
Frost Bank’s Data Breach Investigation
According to Sefas Innovation’s own disclosure, the company discovered on or about April 16, 2026 that an unauthorized party had gained access to a secure file transfer protocol (SFTP) server that Sefas uses to provide software support to its clients, including Frost Bank. Sefas launched an investigation with the help of cybersecurity specialists, which determined that files were downloaded from the SFTP server intermittently between December 2025 and April 2026.
Sefas notified Frost Bank of the incident on April 22, 2026, and Frost Bank began sending written notification letters to affected customers on May 20, 2026. A notice was also filed with Montana’s Office of Consumer Protection, which reported that 74 Montana residents were among those affected; other public reporting has indicated a considerably larger number of Frost Bank customers nationwide were affected by the same incident.
Vendor-related data breaches like this one have become an increasingly common way for financial institutions’ customer data to be exposed. Banks routinely rely on third-party companies to handle document processing, statement printing, and software support, which means a single compromised vendor system can expose the records of customers across multiple client institutions at once. Notification letters following a vendor breach are frequently sent months after the underlying intrusion is first discovered, since the vendor typically must first determine which of its clients’ customers were affected before any notice can go out.
The combination of Social Security numbers, account numbers, and other financial details reported to have been involved in this incident is particularly valuable to identity thieves, who can use it to open new lines of credit, file fraudulent tax returns, or gain access to existing financial accounts. Consumers who receive a notification letter regarding this incident are encouraged to act promptly to protect themselves.
Financial institutions are frequent targets for cybercriminals precisely because of the volume and sensitivity of the personal and account data they, and the vendors that support them, maintain. Banks typically outsource functions such as statement printing, tax document fulfillment, and software support to specialized third-party providers to reduce costs and improve efficiency, but doing so also means customer data leaves the bank’s own hardened security perimeter and comes to rest on a vendor’s systems, which may not be subject to the same level of scrutiny or investment in cybersecurity defenses. When a vendor’s systems are compromised, the bank’s customers can bear the consequences even though the bank itself was never directly breached.
Regulatory notification timelines for incidents like this one can also stretch on for months. A vendor must first determine the scope of an intrusion, identify which of its client institutions were affected, and then work with each client to determine which individual customers need to be notified, all before a single notice can be mailed. In this case, more than a month passed between Sefas’s discovery of the unauthorized access and its notification to Frost Bank, and roughly another month passed before Frost Bank began mailing letters to affected customers. That kind of delay is common in vendor-driven breaches, but it also means affected individuals may not learn that their information was compromised until long after the fact, during which time their data could already have been misused.
Beyond the immediate risk of fraudulent account openings or tax filings, exposed Social Security numbers and financial account details also increase the risk of targeted phishing attempts, in which scammers pose as a bank, government agency, or credit monitoring service to try to extract even more sensitive information from breach victims. Consumers affected by this incident should be especially cautious of unsolicited calls, texts, or emails referencing the breach, and should independently verify the identity of anyone requesting personal or financial information before responding.
When Did This Breach Occur?
Sefas Innovation has stated that unauthorized access to its SFTP server occurred intermittently between December 2025 and April 2026, and that the incident was discovered on or about April 16, 2026. Frost Bank was notified of the incident on April 22, 2026, and began sending notification letters to affected customers on May 20, 2026.
What Information Was Breached?
According to public reporting on the notices sent to affected Frost Bank customers, the information involved may have included names, addresses, Social Security numbers or other taxpayer identification numbers, account numbers, dates of birth, and loan numbers.
What You Can Do
If you received a notification letter about this incident, consider taking the following steps:
- Enroll in any free credit monitoring or identity protection services offered in your notification letter
- Place a fraud alert or credit freeze with the three major credit bureaus (Equifax, Experian, and TransUnion)
- Regularly review your bank and credit card statements for unauthorized activity
- Request and review a free copy of your credit report at annualcreditreport.com
- Watch for phishing attempts referencing the breach, and never provide personal information in response to an unsolicited call or email
File a Data Breach Lawsuit Against Frost Bank
If you received a notice that your information was involved in the Frost Bank data breach, you may have legal options. Companies that share sensitive customer information with third-party vendors are expected to ensure those vendors maintain reasonable security measures, and when that fails, affected customers can face a real risk of identity theft and fraud.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
