Bank account numbers & PINs leaked in cybersecurity attack at Charlotte-based AvidXchange

CHARLOTTE — Nearly 7,000 customers may have had their financial account information leaked in a cybersecurity attack at Charlotte-based AvidXchange that began in March.

The Office of the Maine Attorney General published information pertaining to the data breach, stating the breach occurred on March 2, 2023.

In the letter to customers dated Oct. 13, AvidXchange said they detected it in early April during a routine security monitoring protocol.

In May, potentially thousands of customers’ bank account information was published, according to a statement published on their website dated June 15. Customers impacted were contacted as the investigation continued in the following months.

The letter stated there was no indication of identity theft or fraud, but the data sets “contained confidential information from our files, including personal information.”

>> Below, see the letter template AvidXchange sent to affected customers

The data breach notice by the Office of the Maine Attorney General stated that financial account numbers or credit/debit card information was acquired in combination with PINs and passcodes.

AvidXchange offered identity theft protection services to those impacted and detailed how consumers can secure their personal information:

• Resetting all passwords company-wide (service accounts and teammate passwords).
• Implementing additional logging and process restrictions, like a duo-factor authentication.
• Adding additional conditional access policies to ensure logins come from known, trusted sources
• Establishing separate, cloud-based user accounts

AvidXchange provided Channel 9 with a statement, stating that their products are no longer threatened.

“Based on the results of our extensive investigation and the enhancements we have implemented to date, we are confident that our products remain secure and safe to use,” the statement read. “The files contain some customers’ confidential data and personally identifiable information that largely relates to current and former employees and their dependents.”

North Carolina residents can call the Office of the Attorney General of North Carolina at 1-919-716-6400 for questions pertaining to data breaches and identity theft.

The impacted customers in this data leak have been notified, AvidXchange says.

Channel 9 reached out to AvidXchange for a statement.

(WATCH: How criminals use common security feature to access your bank accounts)

How criminals use common security feature to access your bank accounts

©2023 Cox Media Group