Frost Bank data breach: tax forms and bill-pay check images taken from a vendor's file server

What happened in the Frost Bank breach?

Sefas provides document composition software and software development to Frost Bank, and supports it through a secure file transfer protocol (SFTP) server. On or about April 16, 2026, Sefas learned that an unauthorized group claimed to have data tied to one of the organizations it supports. Its investigation found activity consistent with unauthorized access to that SFTP server. Sefas told Frost Bank on April 22, 2026.

Sefas says it found no sign that the activity went beyond the SFTP server or continued after April 16, 2026.

Date	What the letter and the regulators' records say
December 6, 2025	Breach date on the California record
December 2025 to April 2026	Files downloaded from the SFTP server at intervals
April 16, 2026	Sefas learns that a group claims to hold the data
April 22, 2026	Sefas tells Frost Bank
May 20, 2026	Letter date; recorded by California and Massachusetts; posted on the Texas list

Frost Bank learned of the incident from its vendor, and the vendor learned of it through the group's claim. Letters reached customers 34 days after Sefas learned of the claim.

What did Frost's parent company tell investors?

Frost Bank's parent, Cullen/Frost Bankers, Inc., reported the incident in its quarterly report for the period ended June 30, 2026, filed with the SEC on July 30, 2026. It says that Sefas Innovation, Inc., a third-party vendor used by Frost Bank, notified it on April 22, 2026 of a cybersecurity incident that likely involved certain Frost Bank customer data. The company says the incident did not affect its own systems or networks or disrupt its operations, and was not reasonably likely to have a material impact on its financial condition or results.

EDGAR's filing index lists no Form 8-K from Cullen/Frost under Item 1.05 or Item 8.01 between April 1 and November 12, 2026. The next quarterly report, for the period ended September 30, 2026 and filed on October 29, 2026, does not name Sefas or the incident.

What information was involved?

The files held copies of a tax information form and bill-pay check images. Those include the customer's name, address, Social Security or other taxpayer identification number, account numbers, date of birth and loan numbers.

Item	In the letter	Texas record	Massachusetts record
Name and address	Yes	Yes	Not a category
Social Security or taxpayer ID number	Yes	Yes	Yes
Account and loan numbers	Yes	Financial information	Financial account: yes
Date of birth	Yes	Yes	Not a category
Driver's license	Not listed	Not listed	Not breached

Did the Sefas breach affect other banks?

Yes. Frost was not the only bank whose files were on the server. Sefas filed a second letter in Massachusetts, this one about Monson Savings Bank, and it describes the same intrusion. It says that on or about April 16, 2026, Sefas became aware of an unauthorized group claiming to hold data tied to one of the organizations it supports. The investigation found unauthorized access to the SFTP server Sefas uses for software support, at various periods between December 2025 and April 2026, and the server held files with Monson Savings Bank data.

The Monson letter adds a link in the chain that the Frost letter does not have. Sefas says it told "the bank service provider" about the incident on April 22, 2026, and gave it information so that it could review the data and work out whose information was involved. So Monson's files reached Sefas through a provider that serves the bank, not from the bank directly. The letter does not name that provider. Massachusetts logged the Monson report on July 14, 2026, with 7,783 residents and financial account numbers marked.

Bank	Record	Date	Count	Data marked
Frost Bank	Texas Attorney General	May 20, 2026	191,848 Texans	Name, address, SSN, financial information, date of birth
Monson Savings Bank	Massachusetts OCABR, report 2026-1137	July 14, 2026	7,783	Financial account numbers

Monson's letter offers 24 months of credit monitoring and identity protection through Cyberscout, a TransUnion company, and asks the reader to enroll, because Sefas cannot do it for them. The Monson letter does not say how many other organizations had files on the server.

Why did I get a letter from Sefas instead of Frost Bank?

The letter comes from Sefas because the breach was on Sefas's server. The data was the bank's, and the California record is filed under Frost Bank's name. The guide to bank, brokerage and mortgage breach notices and the guide to vendor breach notices compare other letters sent by a vendor on a client's behalf.

What is being offered?

Twelve months of credit monitoring, a credit report and a credit score from Cyberscout, a TransUnion company, with fraud assistance. Enrollment must be within 90 days of the letter.

Item	Detail from the letter
Provider	Cyberscout (TransUnion)
Length	12 months from enrollment
Enrollment	bfs.cyberscout.com/activate, within 90 days of the letter date
Phone	1-844-593-8461, Monday to Friday, 8:00 a.m. to 8:00 p.m. ET, excluding major U.S. holidays
Sefas contact	20 Burlington Mall Road, Suite 210, Burlington, MA 01803; +1 (781) 757-3011

What the documents leave open

• Which group made the claim, and whether it published any data.
• How the group got into the SFTP server.
• How many Frost Bank customers were affected in total. Texas counts only Texans, and the letter gives no total.
• Whether other Sefas clients' data was on the same server.