HSBC HOLDINGS PLC

HSBC Bank USA mistakenly emailed documentation containing personal information, including Social Security numbers, telephone numbers, email addresses, and limited account identifiers, to an unintended recipient on August 18, 2026. The error was discovered on August 19, 2026. HSBC requested deletion of the email from the recipient's mailbox and obtained confirmation of deletion. Affected individuals are offered 24 months of credit monitoring and identity theft protection.

Background On 21 May 2018 and 30 May 2018 respectively, the Personal Data Protection Commission (the “Commission”) received complaints from two individuals that HSBC Bank (Singapore) Limited (“HSBC”) had sent them a marketing email (the “Email”) without their consent (the “Incident”). HSBC reported the Incident to the Commission voluntarily on 25 May 2018. As reported by HSBC, the Email was a “test email”, and it had intended to send the Email only to HSBC’s employees to test their eDM (electronic direct mail) platform. However, due to incorrect configurations set on the eDM platform, The Email was sent to a significant number of email addresses (more than 100,000). This number included email addresses of individuals who had withdrawn their consent to receive marketing emails from HSBC.The individuals had received the Email twice, as it was sent once on two consecutive days. No personal data was disclosed in the Incident. Remedial Actions HSBC rectified the configuration settings immediately upon finding out about the error. In addition, to prevent recurrence of similar incidents, HSBC introduced a checklist to ensure all procedures were adhered to prior to the sending of eDMs. It also cleaned up its existing database. Undertaking The Commission considered the circumstances of the case and accepted an undertaking from HSBC to improve its compliance with the Personal Data Protection Act 2012. The undertaking was executed on 20 January 2020 (the “Undertaking”). The Undertaking provides that HSBC was to: (a) review and update its procedure for the sending of eDMs using its emailing platform to ensure that any error or omission in setting or configuration does not result in the mass dispatch of eDMs to all email addresses stored in its database; (b) review the training provided for its employees involved in the eDM process, particularly in the steps necessary to select an

HSBC Bank USA, National Association reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2019-05-10. 3 Massachusetts residents were affected. The report records the breach type as electronic.

HSBC Bank USA, National Association notified the New Hampshire Attorney General of a data breach affecting 1 resident. Unauthorized users accessed online accounts between April 6-10, 2019. Data exposed included names, addresses, account numbers, and transaction history. HSBC suspended access, enhanced authentication, and offered 1 year of credit monitoring.

HSBC Bank USA, National Association reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2018-11-27. 14 Massachusetts residents were affected. The report records the breach type as electronic.

HSBC Bank USA, National Association notified the NH Attorney General of unauthorized access to online banking accounts between October 29 and November 2, 2018. Four New Hampshire residents were affected. The compromised data included names, addresses, account numbers, and transaction history. HSBC suspended access, enhanced authentication with one-time passcodes, and offered one year of credit monitoring.

HSBC Bank USA, National Association notified the NH Attorney General of unauthorized access to online banking accounts between October 4 and October 14, 2018. 21 New Hampshire residents were affected. Compromised data included names, addresses, account numbers, and transaction history. HSBC suspended affected accounts and enhanced authentication. Credit monitoring was offered.

HSBC Bank USA reported unauthorized access to online banking accounts between October 4 and October 14, 2018. Affected data included names, addresses, account numbers, balances, and transaction history. HSBC suspended access, reset credentials, enhanced authentication, and offered one year of identity monitoring.

HSBC Bank USA, National Association reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2018-07-26. 1 Massachusetts residents were affected. The report records the breach type as electronic.

HSBC Bank USA, National Association reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2018-07-26. 2 Massachusetts residents were affected. The report records the breach type as electronic.