HackingFinanceFinancial accountIdentity (basic)PCIPIILowContained

TD Bank, National Association

bd_2a69ba54da876a88 · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Jul 2, 2026

To disclose

—

Affected

131state residents only

Linked

3 filings

Confidence

68%

Full breach record for TD Bank, National Association →89 incidents on file

TD Bank U.S. notified Massachusetts residents of a data security event involving limited unauthorized access to personal identifying information. The incident was resolved by correcting a system mailing address. The bank provided two years of complimentary Fraud-Defender monitoring and offered account closure/reopening at no cost. No specific count of affected individuals was disclosed.

J jump to incidentP pin to compareR raw source

Incident timeline — partial

? — ?

Breach window unknown

Jul 2, 2026

Filed

—

Corroborated · see linked filings

Compliance clocks stay unassessable until a regulatory filing lands. Dashed segments fill in automatically when corroboration arrives.

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_facb6caf4fa617b02026-06-15 · +17dCandidate
Maine State AGbd_53596ee4f258ffac2026-05-26 · +37dVerified

Name: TD Bank, National Association
norm: td bank national

Name: TD Bank, National Association
norm: td bank national

Discovered: —
Materiality determined: —
Notification sent: —
Affected individuals: 131state-resident count only
Data types: Financial accountIdentity (basic)PCIPII
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Initial access: valid_credentials

During the incident: Updating our system with the correct mailing address
Paying for a complimentary two-year membership to Fraud-Defender
Offering to close existing accounts and open new accounts at no expense
Changes made: Updating our system with the correct mailing address
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 2 states

View merged incident ↗

Maine State AGMay 26 · first

Massachusetts State AG+20d

Massachusetts State AG+37d · this page

Pattern: first filing May 26 (ME), last Jul 2 (MA) — a 37-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.mass.gov/doc/2026-1076-td-bank-us/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 2, 2026
Raw hash: 4c70596f1e2dd66cbe4f3b1512b3d7deba2dd6df06b63adb4995c8e5378627f7

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityTD Bank, National Association

Victim entityTD Bank, National Association

IncidentUnauthorized Access

Stated responseUpdating our system with the correct mailing address

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancewww.mass.gov