HSBC BANK USA, NATIONAL ASSOCIATION

HSBC Bank USA reported unauthorized access to online banking accounts between October 4 and October 14, 2018. Affected data included names, addresses, account numbers, balances, and transaction history. HSBC suspended access, reset credentials, enhanced authentication, and offered one year of identity monitoring.

HSBC Bank USA, National Association reported a data breach to the Oregon Attorney General. The breach was reported on 2016-01-14. The breach occurred during 12/7/2015 - 12/8/2015. The breach was discovered on 12/10/2015. 432,095 individuals were affected. Notice was sent on 1/11/2016.

HSBC Bank, USA reported a data breach to the Montana Attorney General. The breach was reported on 2016-01-13. The breach occurred from 12/7/2015 to 12/8/2015. 80 Montana residents were affected.

HSBC Bank USA, a finance sector entity reported a unauthorized access incident to the Washington Attorney General. The organization became aware of the incident on 2015-12-10 and filed notice on 2016-01-13. 5,270 Washington residents were affected. 34 days elapsed between awareness and notification. 3 days to identify the breach. 0 days to contain the breach.

HSBC Bank USA notified customers that its mortgage servicing provider inadvertently sent encrypted disks containing personal information (names, SSNs, account numbers) to an unauthorized third-party analytics firm between Dec 7-8, 2015. The third party returned the disks without accessing the data. HSBC offered one year of identity monitoring.

HSBC Bank USA, National Association disclosed that account details, including name, account number, property address, loan and payment details, were sent in error to a commercial entity not associated with HSBC. The third party did not view the data and deleted it. HSBC offered one year of credit monitoring and identity theft protection to affected individuals.

HSBC Bank USA National Association notified customers that a resigned employee took account information in late July 2012. Affected data included names, phone numbers, account numbers, and potentially Social Security numbers. HSBC offered one year of credit monitoring.

HSBC Card and Retail Services and HSBC Bank Nevada, N.A. notified the New Hampshire Attorney General on April 25, 2008, of a security incident involving its website's 'Forgot Login Password' page. Unauthorized third parties exploited a scripting vulnerability to view account information using account numbers and the last four digits of Social Security numbers. The incident affected 19 New Hampshire residents. HSBC strengthened authentication, issued new account numbers, and provided one year of credit monitoring.