F500 Financial Svcs Remainder · Financial Data Services · Structural / no discrete incident
Fiserv
Headline
Fiserv's findings are directly consumer-relevant because of how many banks and credit unions run on its infrastructure - a very large share of American community banks' core processing, card issuing and online banking…
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
Fiserv's findings are directly consumer-relevant because of how many banks and credit unions run on its infrastructure - a very large share of American community banks' core processing, card issuing and online banking is Fiserv underneath. That means a consumer's bank could be flawless and their exposure would still run through a vendor they have never heard of and cannot evaluate. Fiserv also owns Clover, the point-of-sale system in a great many small businesses. This is the AMCA and CDK pattern applied to retail banking, and it is one of the most consequential concentration points in this tracker.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Primary source. None recorded — Unverified - heuristic first draft.
Terms
Arbitration
Not independently confirmed this pass — Fiserv operates as a B2B infrastructure provider to banks/credit unions/merchants, meaning individual consumers typically have NO DIRECT contractual relationship with Fiserv itself despite being affected by its security practices.
Data sharing
SERIOUS, DIRECTLY CONSUMER-RELEVANT FINDINGS given how many small banks/credit unions rely on Fiserv's 'invisible' backend infrastructure: (1) A late-January 2026 lawsuit (FiCare Federal Credit Union v. Fiserv Solutions, LLC, M.D. Fla., reported Feb. 2, 2026) alleges Fiserv's 'Virtual Branch Next' online banking platform lacked basic security controls (hacks allegedly beginning in 2024) while Fiserv allegedly assured the credit union its systems were secure, allowing hackers 'shockingly easy' access — attackers took control of credit union customers' accounts and STOLE MONEY DIRECTLY; press reports say Fiserv told customers in December it would charge for a security upgrade. (2) A SEPARATE, brand-new breach (May 2026): the Everest ransomware/extortion group (which has also claimed other incidents documented elsewhere in this tracker) claimed responsibility for compromising Fiserv — Fiserv had not publicly confirmed the incident and has filed no SEC Form 8-K Item 1.05 cybersecurity disclosure, though given Fiserv's role powering core banking systems, digital banking, and the widely-used 'Clover' point-of-sale system, the potential consumer impact could be extensive.
Fees and billing
The FEE-FOR-SECURITY-UPGRADE-AFTER-A-BREACH-IT-CAUSED allegation is a particularly notable, distinct billing practice worth flagging — charging a victim institution for fixing a vulnerability the vendor already knew about.
Contacts
Privacy contact. Not recorded.
Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
No sources are on file for this row yet.
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy fiserv.com/en/about-fiserv/legal/privacy-notice.html | Not fetched yet | NO (HTML only) |
| Terms of service fiserv.com/en/about-fiserv/legal.html | Not fetched yet | NO (HTML only) |
| Website No URL recorded | Not fetched yet | — |
| Primary source No URL recorded Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
No HQ state on file, so no state statute applies by headquarters.