Affirm Holdings, Inc.

Affirm's systems were never touched; the breach was at Evolve Bank & Trust, the sponsor bank that issues the Affirm Card and holds the customer data a fintech front end never keeps. One malicious link inside Evolve exposed names, Social Security numbers, and account details across its fintech partners, and reporting credits LockBit, which leaked the file when the ransom went unpaid. When the ledger lives at the sponsor bank, a fintech's own security is beside the point: the bank is the single door everyone's data waits behind.