HackingStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedPIIFINANCIAL_ACCOUNTIDENTITY_BASICLowContained
U.S. Bank National Association
bd_9272a1e8dbf34f7b · schema v1 · pii pii-v1
Full breach record for U.S. Bank National Association →U.S. Bank National Association notified Massachusetts residents of a security incident involving its service provider, FIS. Unauthorized access resulted in the exposure of cardholders' names, addresses, and credit card numbers. The incident was discovered on May 7, 2026. U.S. Bank is reissuing affected cards and offering one year of complimentary credit monitoring through TransUnion.
Massachusetts clock⏱ MA AG >30d8 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://www.mass.gov/doc/2026-1081-us-bank/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jul 1, 2026
- Raw hash
- 6c6d847d213b2698ff8cc92b3092751f832b876c3d78e9fafbf221fb7948aedd
Reporting entity
- Name
- U.S. Bank National Associationnorm: us bank national
Victim entity
- Name
- U.S. Bank National Associationnorm: us bank national
Incident
- Discovered
- May 7, 2026
- Materiality determined
- —
- Notification sent
- Jun 30, 2026
- Affected individuals
- Not disclosed
- Data types
- PIIFINANCIAL_ACCOUNTIDENTITY_BASIC
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1195 Supply Chain Compromise
- Threat actor
- Partner
- Third party
- via Fidelity National Information Services (FIS)
- Initial access
- supply_chain
Compliance
- Time to disclose
- 8 weeks(55 days from discovery to filing)
- Compliance flags
- MA AG >30d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.