Skip to content
Breach Index · running record

HSBC data breach history (2016-2026): US account takeovers, a UK vendor leak and denied hacker claims

HSBC has had two confirmed incidents affecting customers in the last ten years: unauthorised logins to US online banking accounts in 2018, and a 2025 breach of a third-party platform holding UK business account applications. It has also denied two hacker claims, in 2024 and 2025. Each item below is dated and sourced.

Short answer

Was HSBC hacked?

Yes, at the account level and through a vendor, though not in a breach of HSBC’s core systems that we could find. In October 2018 unauthorised users got into HSBC Bank USA online banking accounts between 4 and 14 October. HSBC told customers it suspended online access to affected accounts, and a spokeswoman said “less than 1 percent of HSBC’s U.S. customers were affected.” Exposed data included names, contact details, dates of birth, account numbers, balances, transactions and statements. Experts said it looked like credential stuffing; HSBC did not confirm the method.

In September 2025 HSBC told UK business banking customers that identity documents, images and contact details given when applying for a business account were exposed through “unauthorised access to a third-party platform”. HSBC said its own systems “are separate and have not been impacted” and offered 12 months of Experian Identity Plus.

HSBC denied hacker claims in May 2024 (a contractor shared with Barclays) and October 2025 (alleged HSBC USA customer data), saying in 2025 that the sample “does not comprise legitimate HSBC customer data.”

Timeline at a glance

  1. 31 Oct 2025HSBC calls a forum claim of HSBC USA customer data false after reviewing the sample. (teiss)Unverified claim
  2. 30 Sep 2025HSBC UK: third-party platform with business account applications accessed; ID documents exposed. (Business Matters)Confirmed
  3. Nov 2025 – Jan 2026Not named in coverage of the SitusAMC or Fried Frank vendor breaches. (Bank Info Security)Not a breach
  4. 10 May 2024HSBC denies an IntelBroker claim against a contractor it shared with Barclays. (The Cyber Express)Unverified claim
  5. 2 Nov 2018HSBC Bank USA notice filed with California AG: accounts accessed 4-14 Oct 2018. (Bank Info Security)Confirmed

Last updated November 13, 2026. Every entry is dated and linked to its source; claims by attackers are labelled as claims, never stated as fact.

HSBC incident timeline, in detail

Confirmed = acknowledged by HSBC, a regulator filing or a court. Reported = credible reporting HSBC has not fully confirmed. Unverified claim = an attacker or leak-site claim.

Oct 2025Unverified claimDark-web claim

Forum claim of HSBC USA customer data; HSBC says it is false

What happened. An unnamed threat actor posted what it said were HSBC USA customer records, including financial and personal information, on a dark-web forum. HSBC told teiss: “The claims made by this threat actor are false,” that it had reviewed the sample and that it “did not originate from any breach of HSBC systems or those of any of our service providers.”

Impact. “There is no indication any HSBC customer data has been exposed,” HSBC said.

Sources: teiss, 31 Oct 2025

Sep 2025ConfirmedThird-party / onboarding platform

Third-party platform holding UK business account applications breached

What happened. HSBC emailed UK business banking customers that a third-party platform holding information from business account applications had been accessed. An HSBC spokesperson said: “We recently became aware of unauthorised access to a third-party platform” and “HSBC’s systems are separate and have not been impacted.” The platform was not named.

Impact. Identity documents, images and contact details supplied when opening a business account. Passwords, PINs and Voice ID were not affected, per Business Matters. HSBC offered 12 months of Experian Identity Plus. No number of affected customers was given.

Sources: Business Matters, 30 Sep 2025

Apr – May 2024Unverified claimThird-party / software vendor (claim)

Hackers claim a contractor serving HSBC and Barclays; HSBC denies any incident

What happened. IntelBroker and Sanggiero claimed on BreachForums to have breached a contractor of HSBC and Barclays in April 2024, offering source code, database, certificate and configuration files and transaction-record samples. Preliminary analysis cited by The Cyber Express pointed to Baton Systems, which did not comment. HSBC said: “We are aware of these reports and confirm HSBC has not experienced a cybersecurity incident” and that “no HSBC data has been compromised.”

Impact. No customer data leak was shown. Barclays, unlike HSBC, acknowledged a reported incident at a software vendor.

Sources: The Cyber Express, 10 May 2024 · Hackread, 9 May 2024

Oct – Nov 2018ConfirmedAccount takeover

Unauthorised logins to HSBC Bank USA online accounts

What happened. HSBC Bank USA filed a customer notice dated 2 November 2018 with California’s attorney general: unauthorised users accessed online banking accounts between 4 and 14 October 2018. HSBC suspended online access to affected accounts and contacted customers to change credentials. A security expert quoted by Bank Info Security said it had “all of the hallmarks” of credential stuffing; HSBC did not confirm the cause.

Impact. Per the notice: full name, mailing and email address, phone number, date of birth, account numbers, account types and balances, transaction history, payee details and statement history. HSBC said fewer than 1% of US customers were affected and offered one year of credit monitoring. It strengthened log-on and authentication.

Sources: Bank Info Security, 7 Nov 2018 · SecurityWeek, 6 Nov 2018

Where the reports disagree

  • How many US customers in 2018? HSBC said “less than 1 percent” and declined to give its US customer count. Bank Info Security estimated about 14,000 from a Telegraph figure of 1.4 million US accounts; that estimate is not HSBC’s.
  • October 2025: some outlets said HSBC acknowledged a denial-of-service attack at the time of the claim (seen via search only). HSBC’s statement to teiss says nothing about one and denies any data exposure.

The pattern across the record

Customers’ reused passwords and vendors’ platforms, not the core bank

The 2018 incident looks like attackers logging in with passwords leaked elsewhere, and the 2025 UK leak was at a third-party onboarding platform. Neither was shown to be a break-in to HSBC’s own network.

Big brands draw false or inflated claims

HSBC has denied two hacker claims in two years. A forum post naming a large bank is not evidence; the bank’s statement and any regulator filing are.

Earlier history: data-handling fines

Before this window, in 2009, the UK Financial Services Authority fined three HSBC insurance units about £3.2 million over weak controls on customer data (via search).

What it means for HSBC customers — and what to do

For HSBC customers the lessons are practical: unique passwords and strong sign-in for online banking, and identity monitoring if you applied for a UK business account and were notified in 2025.

  1. 1.Use a unique password and app-based sign-in

    The 2018 takeovers are typical of reused passwords. Use a password used nowhere else, and the app’s secure key or biometrics.

    Account takeover lab
  2. 2.If your business-account ID documents were exposed, take the Experian offer

    Passport or driving-licence images can be used to open accounts elsewhere. Activate monitoring and watch for new credit in your name or your company’s.

    Identity protection lab
  3. 3.Ignore callers who quote your details back to you

    Knowing your address or account type does not prove a caller is HSBC. Hang up and call the number on your card.

    Voice-clone fraud checklist

CISO takeaways

Practise an account-takeover wave

Detection, lockout, customer contact and regulator notice when logins are the attack.

Account Takeover Lab
Score onboarding and KYC vendors

Platforms that hold ID documents are high-value targets. Score them like core processors.

Vendor Risk Scorecard
Map US state notification duties

HSBC’s 2018 notice went to California’s AG. Know which states need a filing and when.

Notification clock calculator

Sources

Company statements and regulator filings first, then reputable reporting. Reviewed November 13, 2026.

  1. 1.HSBC Bank alerts US customers to data breach — Bank Info Security / GovInfoSecurity, 7 Nov 2018
  2. 2.HSBC Bank USA warns customers of data breach — SecurityWeek, 6 Nov 2018
  3. 3.HSBC warns UK business banking customers of third-party data breach — Business Matters, 30 Sep 2025
  4. 4.HSBC refutes dark web data leak claims after internal review — teiss, 31 Oct 2025
  5. 5.Barclays and HSBC bank data breach claimed by hacker duo — The Cyber Express, 10 May 2024
  6. 6.IntelBroker hacker leaks alleged HSBC & Barclays bank data — Hackread, 9 May 2024
  7. 7.Major US banks gauge their exposure to SitusAMC breach — Bank Info Security, 24 Nov 2025
  8. 8.After Goldman, JPMorgan discloses law firm data breach — SecurityWeek, 13 Jan 2026

Frequently asked questions

Was HSBC hacked?

Customer accounts were. In October 2018 unauthorised users accessed HSBC Bank USA online banking accounts, and in 2025 a third-party platform holding UK business account applications was breached. We found no confirmed break-in to HSBC’s own core systems.

Is there an HSBC data breach in 2025?

Yes, at a vendor: HSBC told UK business banking customers in September 2025 that ID documents and contact details from account applications were exposed on a third-party platform. Separately, HSBC called an October 2025 claim about HSBC USA customer data false.

What data was exposed in the HSBC USA breach?

Per HSBC’s 2018 notice: names, mailing and email addresses, phone numbers, dates of birth, account numbers, types and balances, transaction history, payee details and statements.

Did HSBC offer credit monitoring?

Yes. In 2018 HSBC offered affected US customers one year of credit monitoring and identity theft protection. In 2025 it offered affected UK business customers 12 months of Experian Identity Plus.

Was HSBC part of the SitusAMC or Fried Frank breaches?

HSBC was not named in the coverage we read. SitusAMC coverage named JPMorgan Chase, Citi and Morgan Stanley; the Fried Frank coverage named JPMorgan Chase and Goldman Sachs.

More in the Breach Index

Same sourced, verification-tagged timeline, company by company — compare how peers have fared.

Coinbase data breachFinancial services

Bribed support agents, 69,461 customers, an 8-K.

TransUnion data breachFinancial services

4.4M people via a third-party support app (2025).

Apollo Global Management data breachFinancial services

Social engineering and cloud platforms.

Invesco data breachFinancial services

No confirmed breach; 2024 vendor ransomware in Japan

Or see the full Breach Index and how to read it.

Independent analysis for security-leadership education; not affiliated with or endorsed by HSBC. Facts are attributed to the dated sources above, and anything disputed or unconfirmed is labelled as such. See the full Breach Index.