Fiserv, Inc. data breach (2007–2026)

Identity resolution

Canonical name: FISERV, INC.
Normalized: fiserv— dedupe via name-norm; Microsoft / MSFT collapse to one row
GLEIF LEI: GI7UBEJLXYLGR2C7GV83
SEC EDGAR CIK: 0000798354
Domain: fiserv.com

Disclosure history (3)newest first

GLOBALLeak Siteas victim2026-05-03
Fiserv is a global financial technology company headquartered in Milwaukee, Wisconsin, United States. It provides financial services technology solutions including payment processing, core banking systems, digital banking platforms, and merchant acquiring services. Serving banks, credit unions, retailers, and businesses worldwide, Fiserv operates across the fintech and banking technology industry and is one of the largest providers of financial services infrastructure globally.
⛰️New Hampshire State AGas reporting2008-12-12
Fiserv (via CheckFree business unit) notified New Hampshire AG regarding a Dec 2, 2008 incident where online bill payment traffic was redirected to a malicious site in Ukraine. Approximately 160,000 consumers were potentially exposed to malware attempting to steal credentials. Fiserv provided McAfee remediation and credit monitoring, and notified federal regulators including the FBI and FTC.
⛰️New Hampshire State AGas victim2007-07-30
New Hampshire Attorney General breach notification filed by Certegy – FIS on July 30, 2008. The incident involved unauthorized access to check transaction records containing personal information, including Social Security numbers and names. Affected individuals were notified via letter. The specific scope and number of affected individuals were not detailed in the filing metadata.

Subsidiary disclosures (1)filed by group companies

◈ These filings were made by or about subsidiaries of FISERV, INC. — not by FISERV, INC. itself. Corporate relationships are mapped from GLEIF relationship records and SEC Exhibit 21 filings.

Tracked subsidiaries✦ First Data Corporation

🐻California State AGvia First Data Corporation2012-05-11
First Data Corporation notified the California AG on May 7, 2012, regarding an administrative oversight where limited personal information (names, addresses, SSNs) of approximately 108,500 merchants was shared with three third-party firms (including a First Data subsidiary and a fraud analytics company) for testing credit and risk scoring products. The incident occurred between January and February 2012. The data was sent from application databases, not live transaction data, and no PCI data was impacted. The third parties deleted the data upon request, and First Data sent written notifications to the affected merchants.