FirstBank Says Breach Was Related To Merchants’ Systems Where Account Holders’ Debit Cards Were Used. So Far 50 Customers’ Cards Compromised; Number Could Rise.

After a news report on The Consortium this morning revealed what FirstBank has described as an external security breach that prompted the bank to cancel debit cards of affected account holders, the bank’s marketing and communications manager in the Virgin Islands, Alana Alexander, shared more details about the breach, including the number of customers affected, and the nature of the breach.

Ms. Alexander said the breach was not of the bank’s omline systems, but that of a number of merchants throughout the territory and beyond — whose identities she decided not to reveal — where FirstBank account holders made transactions. She said so far about 50 FirstBank account holders have been identified as affected, although the number could rise. Emails were sent to all those affected, Ms. Alexander assured.

“As a result and to mitigate the risk, we canceled the cards and are distributing new cards,” Ms. Alexander said. She said such occurrences have happened in the past, and the bank has taken similar action to mitigate any potential risk of fraud, identity theft and other illicit activities associated with breach of information.

Ms. Alexander said while the number of affected account holders could rise, the bank did not think it was prudent to cancel the debit cards of all account holders, as FirstBank expressed confidence that the matter was under control. She said bank personnel are specifically assigned to monitor the matter, and that an investigation has been launched.

Relative to naming the merchants whose systems were breached, Ms. Alexander said, “I do know those merchants, but I’m not able to let you know who those merchants are,” citing the ongoing investigation.

The affected debit cards are being canceled on Monday, Ms. Alexander said, because the bank is sensitive to the needs of its clients during the Mother’s Day weekend. On Monday, the current debit cards of affected account holders will be canceled and new ones issued. Customers with immediate needs are encouraged to visit their local branch for a temporary replacement.

The Virgin Islands Consortium was one of the affected FirstBank account holders. In a notice sent to an email tied to the account, the bank said:

“Due to a possible external security incident to FirstBank, your debit card number ending in [redacted] may have been compromised. Given this situation, and to reduce the risk of improper access to your account, we will be canceling your card effective on Monday, May 13, 2019.”

The bank added, “Your deposit account has not been canceled or altered in any way; you will keep your account number and continue to enjoy the same benefits. If you have an additional debit card that has not been committed, you can continue using it. If you need a provisional card while receiving your new card you can visit any of our branches. If you have recurring payments scheduled to your debit card you must exchange them for an alternate payment method in what you receive and set the payments to your new card.”

The notification also said, “As a precautionary measure, we recommend that you stay alert for the next 12 to 24 months and notify us immediately of any incident or suspicion related to identity theft. Check your account statements and inform us immediately of any situation. If you suspect that you have been the victim of identity theft, please call the credit reporting agencies immediately and request that an identity theft alert be placed on your credit report. In addition, you can request your free credit report at any of the credit reporting agencies.”

External threats are usually malicious campaigns that attempt to exploit security exposures in a company’s attack surface that exists outside the firewall. Targeted external threats can compromise employee or customer data security.

Below are the credit reporting agencies’ websites and contact numbers:

Equifax: Website, #: 1-800-525-6285

Experian: Website, #: 1-888-397-3742

TransUnion: Website, #: 1-800-680-7289

To call FirstBank for more information, reach the bank’s Solution Center at 787-725-2511, or call toll free 1-866-695-2511.

The bank said it would continue to take preventive measures to protect customers’ financial relationships.