The Hilltop Bank system in Wyoming has suffered a “cybersecurity incident” in its system and out of caution, disconnected the bank and its backup system from the internet to contain the issue, the bank’s spokesman told Cowboy State Daily on Wednesday.
Hilltop announced Tuesday morning via Facebook that it was having “interruptions” with online and mobile banking and phone service. It later increased debit card limits to $1,000 per day so bank customers could make purchases.
It announced Tuesday afternoon it was still working to resolve the issues, would provide updates as they become available and apologized for the inconvenience.
Wednesday morning, the bank announced all branches and offices would be closed “due to an ongoing IT issue” it was working to resolve.
The bank later discovered that there'd been a cybersecurity incident, Hilltop and True companies spokesman Bill Salvin told Cowboy State Daily in a Wednesday phone interview.
Customers still can use up to $1,000 from their debit cards daily or withdraw money from an ATM using their debit cards, Salvin said.
Everything else is offline. The bank unplugged its backup systems out of caution so they wouldn't be impacted, he said.
People’s automatic transfers for things like car and credit card payments, out of their Hilltop accounts, will not transfer, said Salvin.
“Even if they’re scheduled, we’re in offline mode. So we cannot make those payments,” he said. “If people have late fees because of this incident, we will reimburse them for those late fees.”
Salvin added, “We are truly sorry for the inconvenience this has caused our customers.”
Hilltop customers who spoke to Cowboy State Daily on Wednesday were most frustrated with what they called a lack of transparency.
“(We) absolutely understand that, and part of the issue is we’re in the very early stages of this incident,” said Salvin. “We had some degradation of our system starting yesterday (Tuesday) and we didn’t discover until just after midnight, essentially very early this morning, that this was a cybersecurity incident.”
Hilltop added in a Wednesday Facebook post that it has "procedures, plans, and policies in place to make all customers whole, should we need to. All accounts are also insured by the FDIC up to the established limits."
"We do not have a projected time when the bank and its systems will be back online," says the statement. "We know that is frustrating to hear. However, the most important thing is to ensure that when we bring the bank system back online, we are confident that all systems are no longer compromised and fully operational."
Hilltop bank, which is owned by the H.A. True family, completed its acquisition of Cheyenne State Bank earlier this year.
Hilltop reported in March that upon closing the acquisition it had about $1.11 billion in assets and runs a full-service trust and wealth management department with total assets under management in excess of $1.7 billion.
"This acquisition expands Hilltop Bank’s footprint in Wyoming, building on its existing presence in Casper, Glenrock, Cheyenne, and Gillette," the bank announced at the time.
‘Dead In The Water’
Brent Hartford, who runs an appliance repair business and banks at Hilltop, said the shutdown leaves his business “just dead in the water” transaction-wise.
His wife noticed the outage early Tuesday, he said.
“They’ve always had glitchy issues,” said Hartford of Hilltop.
Giving his interview moments before Salvin spoke with Cowboy State Daily, and moments before Hilltop made a more complete announcement about the cybersecurity incident via Facebook, Hartford lamented what he called a lack of transparency.
“Having a problem is one thing, but ghosting people with information is not good,” said Hartford. “It’s really looking like they’re not capable of handling your money. You know, it really makes people nervous.”
Hartford said he’s considering switching banks, but for a business that’s a huge endeavor.
For today, he’s taking cash or checks only.
Anita Stadler, who said she runs a business out of Casper and had just opened a second Hilltop account, said she hasn’t been able to access online banking since Monday night.
“I don’t know what’s going on,” said Stadler, who also gave her interview moments before Salvin gave his. “I’ve never seen anything like this.”
“I don’t know if my accounts are safe,” added Stadler.
Meg Weeks, who runs an antique shop and banks in Cheyenne, said she’s not prone to giving interviews.
“I wouldn’t even normally return your call, but I’m kinda pissed,” said Weeks.
She said she hasn’t been able to see any bank transactions for a day and a half.
Week’s called it concerning that Hilltop’s Facebook page limited some of the comments.
On Wednesday, Weeks went to Walmart for her monthly grocery shopping trip, she said, adding that she wasn’t sure if her debit card would work.
She placed the order online for pickup.
“And I figured if my card went through, it went through. And if it didn’t, I’d just have to eat from my cupboards,” said Weeks.
She said she lived on a ranch for several years and knows to keep a month’s worth of supplies in the cupboards.
“It went through,” she said.
Of the bank, Weeks added, “Good luck digging up what’s really going on with this outfit.”
… Again?
This is at least the second cybersecurity incident a major Wyoming institution has suffered in the past few weeks.
The Wyoming Judicial Branch’s prior database suffered a breach this spring, which the branch learned about in mid- to late July, its spokesman told Cowboy State Daily.
Personal information from around 10 years, and pertaining to the Wyoming Supreme Court and Wyoming district courts systems, could have been compromised, the branch said earlier this month.
Last Friday, numerous employees of Sweetwater County School District No. 1 were not paid on time, though some reported to Cowboy State Daily they were ultimately paid, just hours later than expected.
The school district did not respond to Cowboy State Daily’s requests for comment.
Clair McFarland can be reached at clair@cowboystatedaily.com.
