MisusePrivilege AbuseCustomer Data InvolvedTargetedIDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTCREDENTIALSMediumContained
Ally Bank
bd_cac6ff3ef5b825e0 · schema v1 · pii pii-v1
Full breach record for Ally Bank →Ally Bank notified Massachusetts and New York residents of a data breach discovered on April 13, 2026. An unauthorized non-Ally employee was inappropriately provided access to customer deposit accounts. Exposed data included names, addresses, SSNs, DOBs, bank account numbers, and transaction details. Ally revoked the employee's access, offered new account numbers, implemented fraud monitoring, and engaged Sontiq (TransUnion) to provide three years of identity theft services.
Massachusetts clock✓ MA AG ≤30d18 days discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://www.mass.gov/doc/2026-727-ally-bank/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- May 1, 2026
- Raw hash
- b349061c916819398faccdf8a570e0b3d75f389513051994242560726c53331f
Reporting entity
- Name
- Ally Banknorm: ally bank
- Domain
- ally.com
Victim entity
- Name
- Ally Banknorm: ally bank
- Domain
- ally.com
Incident
- Discovered
- Apr 13, 2026
- Materiality determined
- —
- Notification sent
- May 6, 2026
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTCREDENTIALS
- Attack vector
- Insider
- MITRE ATT&CK
- T1078 Valid Accounts
- Threat actor
- Internal
- Initial access
- insider_action
Compliance
- Time to disclose
- 18 days(18 days from discovery to filing)
- Compliance flags
- MA AG ≤30d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.