M&T BANK CORPORATION
ent_019e200c034747f187b658aa975a8dd3
Disclosures
17
State AG · HHS OCR · 5 jurisdictions
Multi-filing incidents
3
incidents joining 2+ filings here
Max affected reported
95,261
as filed · State AG MA
Leak-site claims
0
none in sample
Identity resolution
- Canonical name
- M&T BANK CORPORATION
- Normalized
- m t bank— dedupe via name-norm; Microsoft / MSFT collapse to one row
- GLEIF LEI
- 549300WYXDDBYRASEG81
- SEC EDGAR CIK
- 0000036270
- Domain
- mtb.com
Disclosure history (17)newest first
- Massachusetts State AGas victim2026-04-17
M&T Bank notified customers in April 2026 that a third-party service provider experienced a security incident in August 2025. M&T's systems were not directly affected. The provider securely removed customer data. M&T is offering 24 months of Equifax credit monitoring and monitoring accounts for fraud.
- Nebraska State AGas victim2026-04-17
M&T Bank notified Nebraska residents of a data breach involving a third-party service provider in August 2025. Customer personal information, potentially including SSNs and financial account numbers, was accessed. M&T confirmed its systems were not affected and that the provider removed the data. The bank is offering 24 months of free credit monitoring via Equifax and advising customers to monitor accounts.
- Massachusetts State AGas victim2025-08-08
M&T Bank reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2025-08-08. 2 Massachusetts residents were affected.
- Massachusetts State AGas victim2025-03-17
M&T Bank reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2025-03-17. 2 Massachusetts residents were affected.
- Massachusetts State AGas victim2025-03-06
M&T Bank reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2025-03-06. 1 Massachusetts residents were affected.
- Massachusetts State AGas victim2024-12-23
M&T Bank reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2024-12-23. 326 Massachusetts residents were affected.
- Maine State AGas victim2024-01-25
M&T Bank reported that an external system breach (hacking) on May 27, 2023, resulted in the compromise of personal information for 43 Maine residents. The breach was discovered on June 1, 2023. The compromised data includes names and Social Security Numbers. Affected individuals were notified on January 26, 2024, and have been offered 24 months of identity and credit monitoring services through Kroll. The consumer notice attached to the filing is from 'Delta Dental of California and affiliates,' which may indicate the breach originated with a third-party vendor.
- Massachusetts State AGas victim2024-01-25
M&T Bank reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2024-01-25. 161 Massachusetts residents were affected.
- Massachusetts State AGas victim2023-09-26
M&T Bank reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2023-09-26. 95,090 Massachusetts residents were affected. The report records the breach type as electronic.
- Massachusetts State AGas victim2023-08-31
M&T Bank reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2023-08-31. 2 Massachusetts residents were affected. The report records the breach type as electronic.
- Massachusetts State AGas victim2023-08-14
M&T Bank reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2023-08-14. 95,261 Massachusetts residents were affected. The report records the breach type as electronic.
- Massachusetts State AGas victim2023-06-13
M&T Bank reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2023-06-13. 2 Massachusetts residents were affected. The report records the breach type as electronic.
- Montana State AGas victim2020-07-10
Sinai Hospital of Baltimore notified patients that M&T Bank, a vendor managing accounts receivable, experienced an incident where an unknown individual fraudulently obtained copies of patient documents between Dec 17, 2019 and Apr 30, 2020. Data included names, SSNs, health insurance info, and clinical details. Sinai offered credit monitoring.
- Massachusetts State AGas victim2020-07-06
M&T Bank reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2020-07-06. 1 Massachusetts residents were affected. The report records the breach type as electronic.
- NEW YORKHHS OCRas victim2020-06-29
M&T Bank reported to HHS on 2020-06-29 a Unauthorized Access/Disclosure affecting 5,878 individuals. Breached information located on Email. An employee was victim of a social engineering attack compromising PHI including names, addresses, financial/health insurance info, diagnoses, medications, SSNs, and driver's license numbers. The business associate implemented additional safeguards and retrained staff.
- Massachusetts State AGas victim2019-11-14
M&T Bank reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2019-11-14. 1 Massachusetts residents were affected. The report records the breach type as electronic.
- Massachusetts State AGas victim2018-12-19
M&T Bank reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2018-12-19. 1 Massachusetts residents were affected. The report records the breach type as electronic.
Subsidiary disclosures (5)filed by group companies
◈ These filings were made by or about subsidiaries of M&T BANK CORPORATION — not by M&T BANK CORPORATION itself. Corporate relationships are mapped from GLEIF relationship records and SEC Exhibit 21 filings.
- New Hampshire State AGvia LEAF Commercial Capital, Inc.2021-11-29
LEAF Commercial Capital, a subsidiary of People's United Bank, notified the New Hampshire Attorney General of a phishing incident affecting two NH residents. An employee clicked a phishing link on Oct 22, 2021, granting an external actor access to their email. The breach was detected on Oct 23, 2021, when suspicious login activity from Zambia triggered an alert. LEAF disabled the account and reset credentials. The incident involved Social Security Numbers and personal data of two NH residents. Affected individuals were notified and provided two years of credit monitoring via TransUnion.
- Massachusetts State AGvia LEAF Commercial Capital, Inc.2021-11-26
LEAF Commercial Capital reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2021-11-26. 7 Massachusetts residents were affected. The report records the breach type as electronic.
- Massachusetts State AGvia WILMINGTON TRUST COMPANY2018-09-24
Wilmington Trust Company reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2018-09-24. 2 Massachusetts residents were affected. The report records the breach type as paper.
- Massachusetts State AGvia LEAF Commercial Capital, Inc.2017-02-21
LEAF Commercial Capital, Inc reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2017-02-21. 1 Massachusetts residents were affected. The report records the breach type as electronic.
- Massachusetts State AGvia WILMINGTON TRUST COMPANY2015-11-27
Wilmington Trust reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2015-11-27. 1 Massachusetts residents were affected. The report records the breach type as paper.