MisuseFinancial ServicesFinancePrivilege AbuseCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDMediumContained

TD Bank, National Association

bd_2a5b42293968d904 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 2, 2026

Filed

Apr 13, 2026

To disclose

10 weeks

Affected

1state residents only

Confidence

67%

Full breach record for TD Bank, National Association →89 incidents on file

TD Bank notified one Massachusetts resident that their personal information, including name, address, date of birth, and social security number, was compromised by an employee on February 2, 2026. The bank is conducting an internal investigation and offering two years of complimentary identity monitoring services.

J jump to incidentP pin to compareR raw source

Massachusetts clock⏱ MA AG >30d10 weeks discovery → filing

Incident timeline

discovery → filing · 10 weeks / 70 days

Feb 2, 2026

Discovered

Apr 13, 2026

Filed

vs. sector median

+2 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1 affectedView incident

Name: TD Bank, National Association
norm: td bank national

Name: TD Bank, National Association
norm: td bank national
Industry: Financial Servicesllm

Discovered: Feb 2, 2026
Materiality determined: —
Notification sent: —
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Insider
Threat actor: Internal
Initial access: insider_action

During the incident: Addressed through an internal investigation by our corporate security team
Changes made: Taking action to better protect your information in the future
Paying for a complimentary two-year membership to Fraud-Defender, provided by Merchants Information Solutions
Offering to cover all expenses associated with closing existing account(s) and opening new account(s)
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(70 days from discovery to filing)
Compliance flags: MA AG >30d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.mass.gov/doc/2026-565-td-bank/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 13, 2026
Raw hash: 9f89fcb234d71e1477f489036bbebcf56b481e143935c122d63ce6cbe1c92ed5

Reporting entityTD Bank, National Association

Victim entityTD Bank, National Association

Incidentdiscovered Feb 2, 2026

Stated responseAddressed through an internal investigation by our corporate security team

ComplianceMA AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.mass.gov