June 15, 2026: TD Bank U.S. filed a data-breach notification with Massachusetts after discovering an employee had accessed customer records without authorization from January 7 through January 30, per the state's June 2026 breach archive. The letter's data menu is the kind banks hope never ships: Social Security numbers, account numbers, and transactional history—not just names and email addresses.
What TD confirmed
TD's notification, summarized by Daily Hodl and breach summaries citing the Massachusetts PDF, states the personal information that may have been involved includes:
- Name, address, and phone number
- Date of birth
- Social Security number
- Account number
- Transactional data
TD classified the event as an insider incident. At disclosure the bank said it had no evidence of external hacking and no evidence of further misuse—standard language that does not mean the data stayed inside the building.
Public filings reviewed at catalog time did not include a victim count. If you bank with TD in the U.S. and receive a letter, treat the listed fields as compromised regardless of statewide totals.
What TD is offering
According to the notification excerpts, TD is paying for a two-year Fraud Defender membership through Merchants Information Solutions—identity monitoring and resolution services—and said customers who want to close and reopen accounts can contact the bank with fees covered.
That is more than a bare-minimum "we take security seriously" email, but it does not replace a credit freeze if your SSN was in scope.
Why insider breaches at banks still hurt
External ransomware gets the headlines; insiders get the crown jewels quietly. An employee with legitimate access can copy rows that combine government ID numbers with live account identifiers and spending patterns—everything a fraud shop needs for account takeover, synthetic identity reuse, or convincing vishing ("we see a wire pending on your TD checking ending in …").
TD's U.S. retail arm sits on tens of millions of accounts. Even a narrow insider cohort can still mean thousands of high-value profiles.
What to do if you bank with TD
- Read your notification letter carefully for which fields apply to you—not everyone gets every data type.
- Place a credit freeze or fraud alert with Equifax, Experian, and TransUnion if your SSN was involved.
- Turn on transaction alerts for debits, wires, and new payees on all TD accounts.
- Call TD on a published number if anyone texts or emails a link to "verify" your account or approve a transfer.
- Enroll in Fraud Defender if TD offered it in your letter—free is free, but it is not a substitute for freezing credit.
Canonical record
TD Bank 2026 insider breach on BreachHistory.
Sources: Massachusetts TD Bank U.S. notification (PDF), Daily Hodl, UpGuard summary.