AccidentalFinancial ServicesFinanceMisdeliveryCustomer Data InvolvedFinancial accountIdentity (basic)Government IDMediumContained

BANK OF AMERICA CORPORATION

bd_8a39a160ce10b5a2 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Aug 5, 2026

To disclose

—

Affected

1state residents only

Linked

4 filings

Confidence

67%

Full breach record for BANK OF AMERICA CORPORATION →130 incidents on file

Bank of America, N.A. notified Massachusetts residents of a data breach occurring on July 14, 2026. An employee email error resulted in the disclosure of deceased customers' investment account information, including names, Social Security numbers, and account numbers. The company conducted internal investigations, deleted the erroneous email, and is monitoring accounts for suspicious activity. No specific count of affected individuals was disclosed in the filing.

J jump to incidentP pin to compareR raw source

Incident timeline

Jul 14, 2026

Begins

Aug 5, 2026

Filed

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_b1bdc37cd94e1e752026-07-30 · +6dCandidate
Massachusetts State AGbd_47e5c33000132e212026-06-15 · +51dCandidate
Massachusetts State AGbd_9e88b4a7ea3755c52026-05-01 · +96dCandidate

Name: BANK OF AMERICA CORPORATION
norm: bank of america
Domain: bankofamerica.com

Name: BANK OF AMERICA CORPORATION
norm: bank of america
Domain: bankofamerica.com
Industry: Financial Servicesllm

Discovered: —
Breach occurred: Jul 14, 2026
Materiality determined: —
Notification sent: Aug 4, 2026
Affected individuals: 1state-resident count only
Data types: Financial accountIdentity (basic)Government ID
Data elements: Social Security numberDate of birth
Attack vector: Misconfiguration
MITRE ATT&CK: T1566.002 Spearphishing Link
Threat actor: Internal

During the incident: Conducted our own internal investigations to prevent and minimize any financial impact
Monitoring the accounts
Will work with you to resolve unauthorized transactions on the accounts related to this incident if reported in a timely manner
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings

View merged incident ↗

Massachusetts State AGMay 1 · first

Massachusetts State AG+45d

Massachusetts State AG+90d

Massachusetts State AG+96d · this page

Pattern: first filing May 1 (MA), last Aug 5 (MA) — a 96-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.mass.gov/doc/2026-1289-bank-of-america/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 5, 2026
Raw hash: e975ab78c7d829ce686c27b8277ed9365589b1189003035bcff5ea94d34c07a8

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityBANK OF AMERICA CORPORATION

Victim entityBANK OF AMERICA CORPORATION

IncidentMisconfiguration

Stated responseConducted our own internal investigations to prevent and minimize any financial impact

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancewww.mass.gov