AccidentalFinancial ServicesFinanceMisdeliveryCustomer Data InvolvedFinancial accountIdentity (basic)Government IDMediumResolved

HSBC BANK USA, NATIONAL ASSOCIATION

bd_fd0a52b26eb60455 · schema v1 · pii pii-v2

Severity

Medium

Discovered

Aug 19, 2026

Filed

Sep 1, 2026

To disclose

—

Affected

2state residents only

Confidence

69%

Full breach record for HSBC BANK USA, NATIONAL ASSOCIATION →12 incidents on file

HSBC Bank USA mistakenly emailed documentation containing personal information, including Social Security numbers, telephone numbers, email addresses, and limited account identifiers, to an unintended recipient on August 18, 2026. The error was discovered on August 19, 2026. HSBC requested deletion of the email from the recipient's mailbox and obtained confirmation of deletion. Affected individuals are offered 24 months of credit monitoring and identity theft protection.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 1 days

Aug 18, 2026

Begins

Aug 19, 2026

Discovered

Sep 1, 2026

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed2 affectedView incident

Name: HSBC BANK USA, NATIONAL ASSOCIATION
norm: hsbc bank usa national

Name: HSBC BANK USA, NATIONAL ASSOCIATION
norm: hsbc bank usa national
Industry: Financial Servicesllm

Discovered: Aug 19, 2026
Breach occurred: Aug 18, 2026
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Sep 2, 2026
Affected individuals: 2state-resident count only
Data types: Financial accountIdentity (basic)Government ID
Attack vector: Unknown

During the incident: Requested that the unintended recipient delete the email and your information from their mailbox
Obtained confirmation of deletion from the unintended recipient
Changes made: Offering a free 24-month subscription to Identity Defense Total, a credit monitoring and identity theft protection service
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.mass.gov/doc/2026-1487-hsbc-bank/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 1, 2026
Raw hash: 0b940b5ccdfbb3ba909e5d6fed95e1865a5f0a46d0d36f29d24b947f43cb7221

Reporting entityHSBC BANK USA, NATIONAL ASSOCIATION

Victim entityHSBC BANK USA, NATIONAL ASSOCIATION

Incidentdiscovered Aug 19, 2026

Stated responseRequested that the unintended recipient delete the email and your information from their mailbox

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancewww.mass.gov