Invest1 publisher3 min readPublished
Hilltop National is running $987.6 million of deposits through seven part-open branches
The Casper, Wyoming bank has had online and mobile banking down since Sept. 8 and debit cards capped at $1,000 a day. Its only mandatory account of the incident goes to the OCC and the Kansas City Fed.
The Investor · Invest desk
What happened
- Hilltop National Bank in Casper, Wyoming took online and mobile banking offline on Sept. 8 after its IT systems began to degrade, and staff classified the trouble overnight into Sept. 9 as a cybersecurity incident.
- The bank has $1.14 billion in assets and $987.6 million in deposits across eight offices, seven of which have reopened for a narrow set of transactions after all closed on Sept. 9.
- Asked directly, Hilltop would not say what caused the incident, whether any data left its systems, which outside company runs its core banking software, or when service will return.
- Hilltop notified the Office of the Comptroller of the Currency and the Federal Reserve Bank in Kansas City, and no criminal group has listed the bank on a leak site.
Compiled by The InvestorSomething wrong?How this is made
Why it matters
- contradiction The bank's customer notice and its spokesperson describe opposite states for scheduled outgoing payments, so a borrower cannot tell from the record whether to pay a car note or mortgage by hand this week.
- exposure With no SEC trigger applying to a privately owned bank, depositors are left with the bank's own updates while the fuller account goes to supervisors who are not required to publish anything.
- cost Reimbursing late charges and clearing transactions by hand runs for as long as the outage does, and Hilltop did not put a figure on it.
Eight offices, one of them still shut, average about $123 million of deposits each [3][4][1][4]. Since Sept. 8 the counter has been the working channel, and each open office handles only a narrow set of transactions [1][4]. A $1,000 daily debit cap holds a customer's card spending at stores and ATMs to $7,000 across seven days [5][2].
Two versions of the payment problem are on the record. The bank told customers that scheduled outgoing payments for car notes, mortgages and credit card bills would not go out for the time being, and that it will reimburse any late charges the outage causes [6]. On Tuesday a spokesperson told American Banker that "scheduled outgoing recurring payments are going out as normal" [8]. Payments a lender pulls on its own still clear, and direct deposits are arriving [7][18].
On timing, an update to customers said: "We had hoped to give you a definitive time tonight." It went on: "Unfortunately, this process is time and labor-intensive, and, for that reason, we are currently unable to provide that level of detail at this time" [13]. Darren Cantlay, Hilltop's president and chief executive, said "We deeply regret the concern and frustration this has caused all of you" [14].
The reporting Hilltop owes runs to supervisors. Justin Herring, a partner at law firm Mayer Brown, said bank incident-notice rules "are deliberately designed to be confidential" [15]. "Unlike state data breach laws, they are created as part of the regulators' regulatory supervision authority and not as consumer notice rules," Herring said [16]. He said the bank will still owe the OCC a fuller account, "often extensive reporting," and that the public will not see it [17]. Nothing in the rule requires the bank to tell customers anything [23]. Hilltop is privately owned, so the SEC's cyber disclosure rules do not apply to it [11].
A week is long but not novel among small banks. Sawyer Savings Bank in Saugerties, New York closed all four of its branches in early August, and the outage was "likely the result of a data security incident," its president and chief executive, James P. Whitaker, said [19][20]. A group called Storm-1175 listed Sawyer on a leak site on Aug. 7 [21]. TruStage Financial Group, which says it serves 93% of credit unions, took its network offline in mid-July [22].
Nobody has claimed Hilltop on a leak site [12]. That supports two readings at once: containment before anything left the systems, or a negotiation still running. Neither reading changes the operating bill of manual payment handling and reimbursed late charges [6]. In my view the figure to follow is deposits, because $987.6 million funds about 87% of the $1.14 billion balance sheet [3][3], and a depositor in a second week without digital channels has branch hours and a $1,000 cap to work with [5]. If online and mobile banking return this week and the deposit balance holds, this was remediation and overtime, and reading it as a funding problem was wrong.
What to watch
- Whether online and mobile banking come back this week, and whether Hilltop names its core banking provider when they do.
- A leak-site listing naming Hilltop would put exfiltration and an extortion demand on the record; none has appeared.
- Hilltop's next reported deposit balance, measured against the $987.6 million now on the record.