AccidentalFinancial ServicesFinanceMisdeliveryCustomer Data InvolvedFinancial accountIdentity (basic)Government IDMediumContained

BANK OF AMERICA CORPORATION

bd_b1bdc37cd94e1e75 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Jul 30, 2026

To disclose

—

Affected

4state residents only

Linked

4 filings

Confidence

67%

Full breach record for BANK OF AMERICA CORPORATION →130 incidents on file

Bank of America, N.A. notified Massachusetts residents of a data breach occurring on June 30, 2026, where customer bond package documents were lost in transit. The incident potentially exposed names, addresses, Social Security numbers, and account numbers. The bank is monitoring accounts and offering two years of identity theft protection via Experian.

J jump to incidentP pin to compareR raw source

Incident timeline

Jun 30, 2026

Begins

Jul 30, 2026

Filed

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_8a39a160ce10b5a22026-08-05 · +6dCandidate
Massachusetts State AGbd_47e5c33000132e212026-06-15 · +45dCandidate
Massachusetts State AGbd_9e88b4a7ea3755c52026-05-01 · +90dCandidate

Name: BANK OF AMERICA CORPORATION
norm: bank of america
Domain: bankofamerica.com

Name: BANK OF AMERICA CORPORATION
norm: bank of america
Domain: bankofamerica.com
Industry: Financial Servicesllm

Discovered: —
Breach occurred: Jun 30, 2026
Materiality determined: —
Notification sent: Jul 28, 2026
Affected individuals: 4state-resident count only
Data types: Financial accountIdentity (basic)Government ID
Data elements: Social Security number
Attack vector: Unknown

During the incident: Conducted our own internal investigations to prevent and minimize any financial impact
Monitoring your accounts
Arranged for a complimentary two-year membership in an identity theft protection service provided by Experian IdentityWorks
Changes made: Monitoring accounts for suspicious activity
Offering complimentary two-year membership in identity theft protection service
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings

View merged incident ↗

Massachusetts State AGMay 1 · first

Massachusetts State AG+45d

Massachusetts State AG+90d · this page

Massachusetts State AG+96d

Pattern: first filing May 1 (MA), last Aug 5 (MA) — a 96-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.mass.gov/doc/2026-1252-bank-of-america/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 30, 2026
Raw hash: 5b08f63e2595ded1738aee45a2e73a5a72c246b11bfe7b090c56f43547379b49

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityBANK OF AMERICA CORPORATION

Victim entityBANK OF AMERICA CORPORATION

IncidentUnknown

Stated responseConducted our own internal investigations to prevent and minimize any financial impact

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancewww.mass.gov