EarnIn Data Breach

The Texas Attorney General record gives an incident period of April 16 through October 14, 2025. EarnIn's consumer notice says the transfers occurred from April 2025 through October 15 and that the issue was discovered on October 14.

The one-day difference in the reported end date has not been resolved. The Texas record was published on November 12, 2025 and identifies email as the notification method.

According to EarnIn, its system sent encrypted personal information belonging to Lead Bank customers to another partner bank. The incident was therefore an accidental transfer to the wrong recipient, rather than an attacker breaking into the network.

The receiving bank was subject to federal and state regulation and contractual confidentiality obligations. EarnIn did not report a threat actor, malware, or publication of the data on the open internet.

The consumer notice and Texas record list names, mailing addresses, dates of birth, and Social Security numbers.

These are sensitive identity fields. However, the company says the transferred data was encrypted, and the list does not necessarily mean that every field was present for every affected person.

The Texas Attorney General reports 202,480 affected people nationwide, including 21,178 Texas residents. The Texas figure is included in the nationwide total and is not an additional count.

Social Security numbers and dates of birth can support identity theft or fraudulent account applications if obtained by an unauthorized person. In this incident, encryption and delivery to a regulated bank are important conditions that reduce the risk compared with a dataset published openly online.

EarnIn said it had no evidence that the information had been misused or that there was a reasonable threat of identity theft or fraud. People aware of the incident should nevertheless be alert to fraudulent messages claiming to come from EarnIn or a bank.

The company said it secured the affected environment, began an investigation with independent specialists, and reported the incident to the appropriate authorities. It also said the unintended partner bank destroyed the data it had received.

Notice recipients can verify the communication through EarnIn's official support channels and regularly review credit reports and unfamiliar accounts opened in their name.

If an unfamiliar account or application appears, contact the relevant financial institution directly and consider adding a fraud alert or security freeze to the credit file. Do not provide a Social Security number, password, or verification code in response to an unexpected message.