A new ransomware group called Storm has listed six U.S. financial institutions on its leak site: five community banks and Insight Credit Union in Winter Springs, Florida. American Banker reports that the five banks hold about $6.1 billion in assets, and the total rises to about $6.7 billion once the credit union is included, based on FDIC and NCUA call reports. Two of the six have confirmed a breach. Sawyer Savings Bank in Saugerties, New York, has $285 million in assets. According to the Indiana attorney general's breach report, it notified 16,069 people that their names and Social Security numbers were stolen. Insight Credit Union has filed breach notices with state attorneys general. The other four banks have not confirmed or denied an incident.
What Happened
Sawyer Savings Bank closed all of its branches for a week in August. A few days into the closure, Storm added Sawyer to its leak site. Ransomware groups use these sites to name organisations they say they have hit, as a way to pressure them into paying. American Banker reports that the intrusion happened inside the systems of Sawyer's managed service provider, the outside company that runs the bank's IT, and not inside the bank's own environment. The bank has not named that provider.
Storm has also claimed these four banks:
- Pioneer Bank, Albany, New York
- The Cecilian Bank, Cecilia, Kentucky
- First Secure Bank Group, Illinois
- The Poca Valley Bank, Walton, West Virginia
American Banker checked the searchable breach databases published by Texas, Vermont, California, Washington, Indiana and Massachusetts and found none of these four banks. None of the six institutions responded to the outlet's requests for comment. Neither did Constangy, Brooks, Smith & Prophete, the law firm that filed Sawyer's notification. A leak-site listing is only a claim, and ransomware groups sometimes exaggerate what they took or whom they hit. For now, the four unconfirmed banks should be treated as alleged victims.
What Was Taken
Only Sawyer has said publicly what was stolen: the names and Social Security numbers of 16,069 people, according to its filing with the Indiana attorney general. That combination is enough to open fraudulent accounts and apply for credit, and it remains useful to criminals for years. Insight Credit Union's notices confirm a breach, but the reporting so far does not say what data was involved or how many people were affected.
The scale of the other claims is unknown. Storm's listings show what the group says it has. No bank or regulator has confirmed what was taken from the four banks that have not commented. For comparison, Siberpol reports that when Storm listed WindRose Health Network, an Indiana healthcare provider, in mid-August, it posted 15 images as proof but no file list. If Storm does the same with the banks, outsiders will have little evidence to check its claims against.
Why It Matters
Storm is new and growing fast. Check Point Research says the group appeared in August 2026 and claimed more than 50 victims across North America, Europe and Oceania in about six weeks. Its targets include healthcare, finance, manufacturing, government, transportation and critical infrastructure. Surefire Cyber's own count of about 50 claimed incidents by late September is consistent with that.
Storm runs as ransomware-as-a-service, meaning it rents its tools to "affiliates" who carry out the attacks. Check Point says affiliates keep 75% of ransom revenue, rising to 80% and then 90% on revenue above $750,000. That is a generous split, designed to attract experienced attackers from other groups. The group also advertises encryptors for Windows, Linux, ESXi and NAS devices, help evading antivirus and endpoint detection, DDoS attacks, call-centre harassment of victims, and media outreach. Surefire describes a payment portal that does not allow negotiation. It offers a discount that is largest early on and shrinks over time, which pushes victims to decide quickly.
Storm markets itself as "AI powered" and "quantum resistant." Check Point found no evidence of AI in how the group picks targets, deploys ransomware, encrypts data or runs extortion. Its assessment is that the AI claim is mainly a branding and recruitment tool.
A note on names: Microsoft uses "Storm-" followed by a number as a placeholder label for threat clusters it is still tracking. Storm-0940, which Microsoft says used the ARTEX AI framework to compromise ConnectWise Cloud Backup credentials and reach Microsoft 365 tenants, and Storm-2603, which Kaspersky's Securelist links to ransomware delivered through SharePoint's ToolShell flaws, are different actors from the Storm ransomware brand. Microsoft, Huntress, Kaspersky and Check Point have not published anything connecting them to this campaign.
For community banks and credit unions, the main lesson is the role of the IT provider. Sawyer's breach went through its managed service provider. A small institution that outsources IT relies on that provider's security, and one compromised provider can expose several clients at the same time.
The Attack Technique
Sawyer has not said how its managed service provider was compromised, and none of the other five institutions has described an initial access route.
Surefire Cyber has published the only detailed account of how Storm operates, based on its own incident response cases. These may or may not include the banks. In those cases, Surefire says, the attackers:
- Got in by exploiting an authentication bypass in N-able N-central (CVE-2026-18556). N-central is a remote management platform used widely by managed service providers.
- Kept access through legitimate remote access tools, including SimpleHelp and AnyDesk, and sometimes installed a second, unauthorised remote management tool alongside the original access path.
- Evaded defences, in Surefire's assessment, possibly by loading a vulnerable driver to disable security tools, a technique called "bring your own vulnerable driver."
- Stole data and encrypted systems, so victims face both a data leak and an outage.
An entry point through MSP tooling would fit the fact that Sawyer's breach happened at its IT provider. That connection is an inference. Surefire's case data has not been linked to any specific bank.
The ConnectWise incident is a separate case, but it shows the same kind of risk. Huntress reported on October 16 that a stolen ConnectWise Cloud Backup (formerly SkyKick) API secret was used to access customers' Microsoft 365 tenants. In one tenant, a second ConnectWise app gave itself Global Administrator rights and added credentials to other applications. Huntress warns that disabling the affected apps does not remove credentials the attacker has already added.
What Organizations Should Do
- Ask your managed service provider direct questions. Find out which remote management and remote access tools it uses to reach your environment, including N-central, SimpleHelp, AnyDesk and ScreenConnect. Ask for confirmation that they are patched, use multi-factor authentication, and are limited to known IP ranges. Contracts should require the provider to tell you about incidents within hours.
- Patch N-able N-central now for CVE-2026-18556 if you or your provider run it. Review its logs for unexpected logins or newly deployed agents.
- Look for remote access tools nobody approved. Treat any AnyDesk, SimpleHelp or second remote management instance that IT did not deploy as a likely sign of intrusion, and block unapproved remote access tools at the endpoint and the firewall.
- Review third-party app credentials in Microsoft 365. Following Huntress's guidance, list the secrets and certificates on every enterprise app and service principal. Remove anything you don't recognise. Disable abused vendor apps instead of deleting them, so their history is kept for investigation.
- Turn on vulnerable-driver blocking and tamper protection so that endpoint detection cannot be quietly switched off. Alert when a security agent stops reporting.
- Plan for a data-leak extortion, not only an outage. Keep offline backups that you have tested. Encrypt or minimise stored Social Security numbers. Prepare state notification templates and a credit-monitoring vendor before you need them, because Storm's shrinking-discount payment model is designed to rush your decisions.
Sources: Ransomware crew claims 5 banks and a CU; 2 confirm breaches | Storm Ransomware Is Scaling Fast and Selling an AI Powered Image -... | AI-driven, large-scale nation-state campaign using ARTEX ... | AI, Scripts, Operator: Inside the ConnectWise Attack Huntress | How to detect fileless attacks exploiting ToolShell: analyzing the... | ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks Hu... | WindRose Health Network listed on Storm ransomware leak site | Threat Actor Deep Dive: Storm - Surefire Cyber