HackingFinanceSupply Chain (3P Vendor)Customer Data InvolvedFinancial accountPCIPIILowContained

Savers Co-operative Bank

bd_bbf621a605a3c8b3 · schema v1 · pii pii-v1

Severity

Low

Discovered

May 27, 2026

Filed

Jun 23, 2026

To disclose

27 days

Affected

1state residents only

Linked

7 filings

Confidence

66%

Full breach record for Savers Co-operative Bank →345 incidents on file

Savers Bank notified Massachusetts residents of a suspected security breach involving a merchant's network that compromised debit card numbers. The breach was reported by MasterCard International. No fraudulent activity was confirmed, but affected cards were reissued. The notification provided instructions for card activation, destruction of old cards, and monitoring accounts. It also included guidance on credit reporting agencies, fraud alerts, and security freezes.

J jump to incidentP pin to compareR raw source

Massachusetts clock✓ MA AG ≤30d27 days discovery → filing

⚠ notification dateThe stored discovery date equals the NOTIFICATION date, collapsing the clock to ~zero. This UNDERSTATES the delay and can mask a real violation.

Incident timeline

discovery → filing · 27 days

May 27, 2026

Discovered

Jun 23, 2026

Filed

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Massachusetts State AGbd_26348f2f1df491e52026-06-23Candidate
Massachusetts State AGbd_8a5b6fb6fa2acacc2026-06-23Candidate
Massachusetts State AGbd_4fb676c0d44bf70c2026-07-21 · +28dCandidate
Massachusetts State AGbd_360e966706824cce2026-07-23 · +30dCandidate

Show 2 more filings ↓up to 46d gap

Massachusetts State AGbd_bc33f8b8ed9a4c392026-08-01 · +39dCandidate
Massachusetts State AGbd_552579c934e54be62026-05-08 · +46dCandidate

Name: Savers Co-operative Bank
norm: savers co operative bank
Domain: saversbank.com

Name: Savers Co-operative Bank
norm: savers co operative bank
Domain: saversbank.com

Discovered: May 27, 2026
Materiality determined: —
Notification sent: May 27, 2026
Affected individuals: 1state-resident count only
Data types: Financial accountPCIPII
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain Compromise
Threat actor: ExternalFinancial
Third party: via MasterCard International
Initial access: supply_chain

During the incident: Reissuing all affected debit cards
Deactivating old cards in 15 days
Providing toll-free contact numbers for ATM Department and Hot Card Service Center
Changes made: Encouraging customers to monitor account statements
Encouraging sign-up for Online Banking
Providing contact information for credit reporting agencies (Experian, Equifax, TransUnion)
Providing guidance on placing fraud alerts and security freezes on credit reports
Providing contact information for the Federal Trade Commission
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 27 days(27 days from discovery to filing)
Compliance flags: MA AG ≤30d
Discovery-date grounding: notification dateThe stored discovery date equals the NOTIFICATION date, collapsing the clock to ~zero. This UNDERSTATES the delay and can mask a real violation.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings

View merged incident ↗

Massachusetts State AGMay 8 · first

Massachusetts State AG+46d

Massachusetts State AG+46d · this page

Massachusetts State AG+74d

Massachusetts State AG+76d

Massachusetts State AG+85d

Pattern: first filing May 8 (MA), last Aug 1 (MA) — a 85-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.mass.gov/doc/2026-1015-savers-bank/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 23, 2026
Raw hash: a3b03f6323b81269a2f8476a0d8906e6e8adb5760b04478ab71805c28bafeaae

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entitySavers Co-operative Bank

Victim entitySavers Co-operative Bank

Incidentdiscovered May 27, 2026

Stated responseReissuing all affected debit cards

ComplianceMA AG ≤30d

Extraction provenanceno artifact recorded

Source provenancewww.mass.gov