HackingFinancial ServicesFinanceStolen CredentialsCustomer Data InvolvedTargetedFinancial accountIdentity (basic)Government IDMediumContained

Frost Bank

bd_8b776d1a699a96f9 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

May 20, 2026

To disclose

—

Affected

133state residents only

Linked

6 filings

Confidence

67%

Full breach record for Frost Bank →

Frost Bank notified Massachusetts residents of a cybersecurity incident involving unauthorized access to customer records. The breach compromised personal information including Social Security numbers and dates of birth. The bank provided affected individuals with guidance on obtaining free credit reports, placing security freezes, and filing fraud alerts. No police report was filed, and law enforcement did not request a delay in notification.

J jump to incidentP pin to compareR raw source

Incident timeline — partial

? — ?

Breach window unknown

May 20, 2026

Filed

—

Corroborated · see linked filings

Compliance clocks stay unassessable until a regulatory filing lands. Dashed segments fill in automatically when corroboration arrives.

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteeverestbd_5a86e8b29efb82bf2026-04-20 · +30dVerified

Regulatory filings (4) · sorted by filing gap

Texas State AGbd_5f4aac65b3dc3f392026-05-20Verified
Vermont State AGbd_9bc98c2af470155e2026-05-20Verified
California State AGbd_b213ce708cd456a52026-05-20Verified
Montana State AGbd_57500bb26b4174d52026-05-19 · +1dCandidate

Name: Frost Bank
norm: frost bank
Domain: frostbank.com

Name: Frost Bank
norm: frost bank
Domain: frostbank.com
Industry: Financial Servicesllm

Discovered: —
Materiality determined: —
Notification sent: —
Affected individuals: 133state-resident count only
Data types: Financial accountIdentity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: ExternalFinancial
Initial access: valid_credentials

During the incident: Sent notification letters to affected individuals
Provided information about credit monitoring and free credit reports
Provided information about security freezes and fraud alerts
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Montana State AGMay 19 · first

Texas State AG+1d

Vermont State AG+1d

California State AG+1d

Massachusetts State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.mass.gov/doc/2026-820-frost-bank/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 20, 2026
Raw hash: 353c45b16281db6f8da1450034df13920e26fded8972c6596035ec27f844e85a

Linked disclosures

Ransomware claims (1)

Regulatory filings (4) · sorted by filing gap

Reporting entityFrost Bank

Victim entityFrost Bank

IncidentUnauthorized Access

Stated responseSent notification letters to affected individuals

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancewww.mass.gov