Webster Bank, N.A. · Governance finding · severity 3 of 5
Unauthorized actors accessed the systems of Guardian Analytics, a fraud-detection vendor that uses "behavioral analytics and machine learning", between November 2022 and January 2023 and took Webster Bank customer data, including names, account numbers and, for some, Social Security numbers. The vendor is an AI/ML provider, but the breach itself was a conventional intrusion into its systems, not an attack on or by its machine-learning models. Per the Connecticut Attorney General, 157,629 Connecticut residents were affected; on 21 October 2024 Guardian and its successor Actimize settled the state's claims for $500,000 and security commitments. A federal court in New Jersey gave final approval in June 2024 to a $1,430,207.50 class settlement with Guardian, Actimize and Webster Bank.
Record last reviewed Oct 21, 2026 · Markdown
Date
Nov 27, 2022 · disclosed Apr 18, 2023
Institution
Country
United States
AI system
Guardian Analytics behavioural fraud analytics · Machine-learning fraud-detection service holding bank customer data · vendor: Guardian Analytics (NICE Actimize)
AI?
Machine-learning system (inferred from the record)
The sources describe a machine-learning model; nobody on the record labelled it AI.
Category
Status
Settled
Severity
3 of 5
Impact
$500,000 state settlement; $1,430,207.50 class settlement fund · 157,629 Connecticut residents who were Webster Bank customers (per the Connecticut AG); the total across all states was not stated by the AG · Exposed data included names, account numbers and transaction information, including Social Security numbers for some customers.
What happened?
Webster Bank provided customer information to Guardian Analytics, a third-party fraud-monitoring vendor. Per the Connecticut Attorney General, "Guardian uses behavioral analytics and machine learning to help prevent banking fraud for its client institutions", and banks such as Webster must supply names, account numbers and transaction information, which can include Social Security numbers, to use the service.[1]
According to the class-action record, unauthorized individuals accessed Guardian's network between 27 November 2022 and 22 January 2023 and acquired or had access to names, Social Security numbers and financial account numbers. Webster's notification letter, as reported by WFSB, said it learned of the incident on 26 January 2023 and that the attackers later posted the acquired files on the internet. The record does not describe the breach as involving Guardian's machine-learning models; the Attorney General attributed it to inadequate data security at Guardian and to Actimize failing to properly inventory and integrate Guardian's systems after buying it.[1][2][3]
In April 2023 the Connecticut Attorney General's office said 153,754 Connecticut residents were affected, 36,476 of them with Social Security numbers exposed; its October 2024 settlement announcement put the figure at 157,629 Connecticut residents who were Webster customers. Six class actions filed from April 2023 were consolidated in the District of New Jersey against Guardian, Actimize and Webster Bank.[1][2][3]
When did it happen?
- Nov 27, 2022
Unauthorized access to Guardian Analytics' systems begins, per the class-action record.[2]
- Jan 22, 2023
The unauthorized access ends.[2]
- Jan 26, 2023
Webster learns of the incident at Guardian, according to its notification letter.[3]
- Apr 14, 2023
The first class action is filed in the District of New Jersey against Guardian, Actimize and Webster Bank.[2]
- Jun 5, 2024
The court grants final approval of a $1,430,207.50 class settlement.[2][4]
- Oct 21, 2024
Connecticut AG William Tong announces a $500,000 settlement with Guardian and Actimize requiring security commitments.[1][4]
What was the impact?
- Financial: $500,000 state settlement; $1,430,207.50 class settlement fund[1][2]
- Customers: 157,629 Connecticut residents who were Webster Bank customers (per the Connecticut AG); the total across all states was not stated by the AG[1][2]
- Other: Exposed data included names, account numbers and transaction information, including Social Security numbers for some customers.[1][2]
Severity 3 of 5: Material harm and a regulatory consequence: names, account numbers and some Social Security numbers of 157,629 Connecticut residents were exposed, leading to a $500,000 state settlement and a $1,430,207.50 class settlement.
How did Webster Bank, N.A. respond?
Webster said in a statement to WFSB in April 2023 that Guardian Analytics "experienced a data security incident which resulted in unauthorized release of certain Webster information", that it had notified regulators and was notifying individuals, that "Webster's own systems have not been compromised nor were they impacted by this incident", and apologised to clients; it offered 24 months of credit monitoring. Guardian and Actimize agreed in the state settlement to encryption, multi-factor authentication, annual risk assessments and a third-party security assessment, and each defendant in the class settlement agreed to implement data-security measures for two years.[1][2][3]
What was the outcome, and did regulators act?
Settled. Guardian and Actimize paid Connecticut $500,000 and accepted a list of cybersecurity commitments; the consolidated class action against Guardian, Actimize and Webster Bank settled for $1,430,207.50, with final approval on 5 June 2024. No finding was made against Webster Bank's own systems.[1][2][4]
Was AI involved in the Webster Bank data breach?
Only in the sense that the breached vendor sells AI. Guardian Analytics provides machine-learning fraud analytics, per the Connecticut Attorney General, which is why it held Webster customer data. The breach itself was unauthorized access to Guardian's systems; no source says its models were attacked or caused the exposure.
How many Webster Bank customers were affected by the Guardian Analytics breach?
The Connecticut Attorney General put the figure at 157,629 Connecticut residents who were Webster customers. Exposed data included names, account numbers and, for some, Social Security numbers. The AG did not give a total for other states, and this record does not infer one.
What penalties followed the Guardian Analytics breach?
Guardian and its successor Actimize agreed in October 2024 to pay Connecticut $500,000 and adopt security measures such as encryption and multi-factor authentication. Separately, a class action against Guardian, Actimize and Webster Bank settled for $1,430,207.50, approved in June 2024.
What did Webster Bank say about the breach?
Webster told WFSB in April 2023 that the incident happened at its fraud-monitoring vendor, that its own systems were not compromised, that it had notified regulators and customers, and it apologised. It offered affected customers 24 months of credit monitoring.
- Attorney General Tong Announces $500,000 Settlement with Guardian Analytics Following Data Breach official
- Opinion for Final Approval of Settlement and Class Certification, No. 2:23-cv-2115 (Guardian Analytics, Actimize and Webster Bank, defendants) court
- Thousands in CT have personal information exposed after Webster Bank data breach news
- CT settles with machine learning company over Webster Bank data breach news
When AI goes wrong at a bank, the next morning's brief says so.
when one of these regulators moves, the next morning's brief says so · six sourced stories · 7 am PT · free
plus every regulation, bank and agent page update, the morning after · leave any morning