HackingFinancial ServicesFinanceStolen CredentialsCustomer Data InvolvedFinancial accountPCILowActive

Main Street Bank

bd_3c8bc65216618548 · schema v1 · pii pii-v1

Severity

Low

Discovered

May 5, 2026

Filed

Jun 8, 2026

To disclose

5 weeks

Affected

1state residents only

Confidence

65%

Full breach record for Main Street Bank →208 incidents on file

Main Street Bank notified Massachusetts customers of a suspected data compromise affecting a merchant's payment card environment from July 1, 2025, to May 5, 2026. The incident potentially exposed card names, numbers, and expiration dates. The bank stated its own systems were not compromised and that no SSNs or account numbers were retrieved. Customers were offered new debit cards and advised to monitor statements, place fraud alerts, and consider security freezes.

J jump to incidentP pin to compareR raw source

Massachusetts clock⏱ MA AG >30d5 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 308 days

discovery → filing · 5 weeks / 34 days

Jul 1, 2025

Begins

May 5, 2026

Discovered

Jun 8, 2026

Filed

vs. sector median

4 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1 affectedView incident

Name: Main Street Bank
norm: main street bank

Name: Main Street Bank
norm: main street bank
Industry: Financial Servicesllm

Discovered: May 5, 2026
Breach occurred: Jul 1, 2025 – May 5, 2026
Undetected for: 308 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 3, 2026
Affected individuals: 1state-resident count only
Data types: Financial accountPCI
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain Compromise
Threat actor: Partner
Initial access: supply_chain

During the incident: Offered Instant issued card
Offered to mail new MSB debit card
Advised customers to review account statements
Advised customers to monitor account activity via Internet Banking
Advised customers to notify bank of suspicious activity
Advised customers to contact credit reporting agencies (Experian, Equifax, Trans Union)
Advised customers to place a free 90-day fraud alert on credit file
Advised customers to obtain free annual credit report
Advised customers to learn about identity theft via FTC guidance
Advised customers to place a security freeze on consumer credit report
Changes made: Provided guidance on security freeze and fraud alert procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(34 days from discovery to filing)
Compliance flags: MA AG >30d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.mass.gov/doc/2026-926-main-street-bank/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 8, 2026
Raw hash: 8bf1d14dca0259cd3eb83dfbac6f9f6c40dcc0abc3440e9238df82757add560d

Reporting entityMain Street Bank

Victim entityMain Street Bank

Incidentdiscovered May 5, 2026

Stated responseOffered Instant issued card

ComplianceMA AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.mass.gov