HackingStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedPCIFINANCIAL_ACCOUNTLowActive
Main Street Bank
bd_3c8bc65216618548 · schema v1 · pii pii-v1
Full breach record for Main Street Bank →Main Street Bank notified Massachusetts customers of a suspected data compromise affecting a merchant's payment card environment from July 1, 2025, to May 5, 2026. The incident potentially exposed card names, numbers, and expiration dates. The bank stated its own systems were not compromised and that no SSNs or account numbers were retrieved. Customers were offered new debit cards and advised to monitor statements, place fraud alerts, and consider security freezes.
Massachusetts clock✓ MA AG ≤30d27 days discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://www.mass.gov/doc/2026-926-main-street-bank/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jun 1, 2026
- Raw hash
- 8bf1d14dca0259cd3eb83dfbac6f9f6c40dcc0abc3440e9238df82757add560d
Reporting entity
- Name
- Main Street Banknorm: main street bank
Victim entity
- Name
- Main Street Banknorm: main street bank
Incident
- Discovered
- May 5, 2026
- Materiality determined
- —
- Notification sent
- Jun 3, 2026
- Affected individuals
- Not disclosed
- Data types
- PCIFINANCIAL_ACCOUNT
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1195 Supply Chain Compromise
- Threat actor
- Partner
- Initial access
- supply_chain
Compliance
- Time to disclose
- 27 days(27 days from discovery to filing)
- Compliance flags
- MA AG ≤30d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.