Digitaldoors, Inc. v. SouthPoint Bank

On March 25, 2026, SouthPoint Bank filed a lawsuit against Digitaldoors, Inc. in the U.S. District Court for the Northern District of Georgia, alleging that a vulnerability in Digitaldoors’ multi-factor authentication API allowed threat actors to bypass security and initiate unauthorized wire transfers exceeding $5.2 million. Digitaldoors countersued, asserting that the bank’s failure to apply critical security patches and enforce internal access controls constituted gross negligence. The breach, which occurred in early February 2026, exploited a zero-day flaw that Digitaldoors had reportedly disclosed to the bank three weeks prior. SouthPoint claimed Digitaldoors’ software contained inherent design defects, while Digitaldoors argued that the bank’s delayed response and weak monitoring were the proximate causes. The case quickly drew attention from financial regulators and the cybersecurity industry due to the high-profile nature of the attack and the complex allocation of liability between a fintech vendor and a federally insured financial institution.

On May 18, 2026, the jury returned a mixed verdict. SouthPoint Bank was found 55% responsible for failing to apply the patch and for inadequate transaction monitoring. Digitaldoors, Inc. was found 45% liable for shipping software with a critical authentication flaw. Damages were reduced proportionally, resulting in Digitaldoors paying $2.34 million to the bank. Both sides waived appeals as part of a settlement.

The central dispute was whether the proximate cause of the $5.2 million loss was the software vulnerability supplied by Digitaldoors, or SouthPoint Bank’s own failure to promptly implement the vendor’s patch and maintain adequate internal security controls, thus determining liability for the breach under Georgia tort law and federal banking security guidelines.

The verdict sent shockwaves through the banking and fintech sectors, establishing that financial institutions cannot fully shift breach liability onto technology vendors if their own response falls short. The Office of the Comptroller of the Currency issued updated third-party risk management guidance within weeks, and several banks overhauled their patch-management SLAs. The case became a landmark reference for shared responsibility in cloud-security failures, influencing cyber insurance underwriting and prompting federal proposals for mandatory incident response timelines for critical infrastructure.