July 8, 2024

Re: Notice of Data Breach

<<Sample A. Sample>>,

We are writing to inform you that some of your personal information was recently impacted when Evolve
Bank & Trust (“Evolve”) was the victim of a cybersecurity attack. Evolve provides financial services including
Banking-as-a-Service products to host accounts and provide mobile banking. This incident did not impact
your funds stored with Evolve.

Please read this notice carefully, as it provides up-to-date information on what happened and what we are
doing, as well as information on how you can obtain complimentary credit monitoring.

What happened?

On May 29, 2024, Evolve identified that some of its systems were not working properly. While it initially
appeared to be a hardware failure, we subsequently learned it was unauthorized activity. Evolve promptly
initiated its incident response processes and stopped the attack. No new unauthorized activity on Evolve’s
systems has been identified since May 31, 2024. An investigation with assistance from a cybersecurity firm
was initiated to investigate what happened and what data may have been impacted. Evolve also notified law
enforcement and worked to add further protections to harden its systems.

What personal information was involved?

There is no evidence that the threat actors accessed any customer funds, but it appears the threat actors did
access and download customer information from Evolve’s databases and a file share during periods in
February and May 2024.

Within these downloaded files, Evolve identified the following personal information about you: <<DATA
ELEMENTS>>.

What we are doing:

Evolve is offering you a complimentary 24-month membership to TransUnion’s credit monitoring and identity
theft protection services. We are also providing you with proactive fraud assistance to help with any questions
that you might have or in the event that you become a victim of fraud. These services will be provided by
Cyberscout, a TransUnion company specializing in fraud assistance and remediation services. Please see
Attachment A below for additional details regarding these services. You must enroll by October 31, 2024,
to receive these services.

Prior to the incident, Evolve had a significant number of cybersecurity measures in place. Since becoming
aware of the incident, Evolve has taken steps to further strengthen its security response protocols, policies
and procedures, and its ability to detect and respond to suspected incidents.
What you can do:

It is always a good idea to remain vigilant against threats of identity theft or fraud and to regularly review and
monitor your account statements and credit history for any signs of unauthorized transactions or activity. You
can also enroll in the TransUnion service being offered to you. Additional information about how to protect
your identity and personal information is contained in Attachment B below.

For more information:

A dedicated call center is also being set up to answer your questions about this incident. You may call it toll
free at 866-238-9974, Monday through Friday 8:00 a.m. to 8:00 p.m. ET (excluding major U.S. holidays).

Sincerely,

Customer Support Team

Evolve Bank & Trust

Attachment A – Credit Monitoring Services

To activate your membership and start monitoring your personal information please follow the steps below:

 Ensure that you enroll by: October 31, 2024 (Your code will not work after this date.)
 Visit the TransUnion website to enroll: www.mytrueidentity.com
 Provide your activation code: <<ABC123DEF456>>

Attachment B – More Information about Identity Protection

INFORMATION ON OBTAINING A FREE CREDIT REPORT

U.S. residents are entitled under U.S. law to one free credit report annually from each of the three major
credit bureaus. To order your free credit reports, visit www.annualcreditreport.com or call
toll-free (877) 322-8228.

INFORMATION ON IMPLEMENTING A FRAUD ALERT OR SECURITY FREEZE

You can contact the three major credit bureaus at the addresses below to place a fraud alert on your credit
report. A fraud alert indicates to anyone requesting your credit file that you suspect you are a possible victim
of fraud. A fraud alert does not affect your ability to get a loan or credit. Instead, it alerts a business that your
personal information might have been compromised and requires that business to verify your identity before
issuing you credit. Although this may cause some short delay if you are the one applying for the credit, it
might protect against someone else obtaining credit in your name.
A security freeze prohibits a credit reporting agency from releasing any information from a consumer’s credit
report without written authorization. However, please be aware that placing a security freeze on your credit
report may delay, interfere with, or prevent the timely approval of any requests you make for new loans,
credit, mortgages, employment, housing, or other services. A credit reporting agency may not charge you to
place, temporarily lift, or permanently remove a security freeze.

To place a fraud alert or security freeze on your credit report, you must contact the three credit bureaus below:

Equifax Experian TransUnion

Consumer Fraud Division Credit Fraud Center TransUnion LLC
P.O. Box 740256 P.O. Box 9554 P.O. Box 2000
Atlanta, GA 30374 Allen, TX 75013 Chester, PA 19022-2000
(888) 766-0008 (888) 397-3742 (800) 680-7289
www.equifax.com www.experian.com www.transunion.com

To request a security freeze, you will need to provide the following information:

1. Your full name (including middle initial as well as Jr., Sr., II, III, etc.);
2. Social Security number;
3. Date of birth;
4. If you have moved in the past five (5) years, the addresses where you have lived over those prior
five years;
5. Proof of current address such as a current utility bill or telephone bill; and
6. A legible photocopy of a government issued identification card (state driver’s license or ID card,
military identification, etc.).

You may also contact the U.S. Federal Trade Commission (“FTC”) for further information on fraud alerts,
security freezes, and how to protect yourself from identity theft. The FTC can be contacted at 400 7th St. SW,
Washington, DC 20024; telephone +1 (877) 382-4357; or www.consumer.gov/idtheft.

ADDITIONAL RESOURCES

Your state attorney general may also have advice on preventing identity theft, and you should report
instances of known or suspected identity theft to law enforcement, your state attorney general, or the FTC.

Colorado and Illinois residents: You may obtain information from the Federal Trade Commission and the
credit reporting agencies about fraud alerts and security freezes.

Iowa Residents: The Attorney General can be contacted at Office of Attorney General of Iowa, Hoover State
Office Building, 1305 E. Walnut Street, Des Moines, Iowa 50319; +1 (515) 281-5164;
www.iowaattorneygeneral.gov.
North Carolina Residents: The Attorney General can be contacted at 9001 Mail Service Center, Raleigh,
NC 27699-9001; +1 (877) 566-7226 (Toll-free within North Carolina); +1 (919) 716-6400; or www.ncdoj.gov.

New Mexico Residents: You have rights under the federal Fair Credit Reporting Act (FCRA), which governs
the collection and use of information pertaining to you by consumer reporting agencies. For more information
about your rights under the FCRA, please visit
https://www.consumer.ftc.gov/sites/default/files/articles/pdf/pdf-0096-fair-credit-reporting-act.pdf or
www.ftc.gov.

New York Residents: The Attorney General can be contacted at the Office of the Attorney General, The
Capitol, Albany, NY 12224-0341; +1 (800)-771-7755; or www.ag.ny.gov.

For Arizona, California, Iowa, Montana, New York, North Carolina, Washington and West Virginia
residents: You may obtain one or more (depending on the state) additional copies of your credit report, free
of charge. You must contact each of the credit bureaus directly to obtain such additional report(s).