JPMorgan Chase data breach history (2016-2026): what the bank confirmed and what came through vendors
JPMorgan Chase is the largest US bank, so its name comes up in many breach stories. This page separates what JPMorgan itself reported (in state attorney general filings and statements) from incidents at vendors that held its clients’ data. Each entry is dated and linked to its source.
Short answer
Was JPMorgan Chase hacked?
We found no confirmed hack of JPMorgan Chase’s own systems from 2016 to 2026 in the sources we read. The bank has, however, reported data exposures. In 2024 it told Maine’s Attorney General that a software flaw let three users tied to its corporate clients see retirement plan participants’ data, including Social Security numbers, for more than 451,000 people. In 2021 a “technology issue” let some customers see other customers’ account details in the app and website.
The more recent incidents came through vendors. In January 2026 JPMorgan notified 659 investors in a private equity fund that files were copied from a shared drive at its outside law firm, Fried Frank. In November 2025 the New York Times and Reuters reported that client data of JPMorgan and other banks may have been accessed in a hack of SitusAMC, a mortgage technology vendor; JPMorgan said its banking systems were not directly compromised.
Timeline at a glance
13 Jan 2026JPMorgan files Maine AG notice: 659 fund investors hit by a breach at law firm Fried Frank. (SecurityWeek / Maine AG)Confirmed
22-24 Nov 2025NYT and Reuters: JPMorgan client data may have been accessed in the SitusAMC vendor hack. (Reuters)Reported
24 Nov 2025JPMorgan says the SitusAMC incident did not directly compromise its banking systems. (Bank Info Security)Reported
Apr 2024Maine AG filing: software flaw exposed data of more than 451,000 retirement plan participants. (InvestmentNews)Confirmed
Aug 2021Montana AG letter: app and website issue let some customers see other customers’ accounts. (Banking Dive)Confirmed
Last updated November 13, 2026. Every entry is dated and linked to its source; claims by attackers are labelled as claims, never stated as fact.
JPMorgan Chase incident timeline, in detail
Confirmed = acknowledged by JPMorgan Chase, a regulator filing or a court. Reported = credible reporting JPMorgan Chase has not fully confirmed. Unverified claim = an attacker or leak-site claim.
Oct 2025 – Jan 2026ConfirmedThird-party / law firm
Law firm Fried Frank breached; JPMorgan notifies 659 private equity fund investors
What happened. JPMorgan filed a notice with the Maine Attorney General’s office in January 2026, SecurityWeek reported. An “unauthorized third party” copied files from a shared network drive at Fried, Frank, Harris, Shriver & Jacobson LLP, an outside law firm. Some files held personal data of investors in a JPMorgan private equity fund. Goldman Sachs had sent a similar notice about the same law firm in December 2025.
Impact. Per SecurityWeek: 659 affected people. Exposed data included names, contact details, account numbers, Social Security numbers, and passport or other government ID numbers. JPMorgan said its own systems were not compromised. SecurityWeek found no ransomware group claiming the attack.
Mortgage technology vendor SitusAMC hacked; JPMorgan among banks named in reports
What happened. SitusAMC, a New York vendor to real estate lenders, said it was hit by a cyberattack on 12 November 2025 and that “data relating to some of our clients’ customers may also have been impacted.” It did not name clients. The New York Times, cited by Reuters, reported that client data of JPMorgan Chase, Citi, Morgan Stanley and other banks may have been accessed. SitusAMC said no encrypting malware was involved and the incident was contained.
Impact. Bank Info Security reported that a JPMorgan spokesperson said the incident did not directly compromise its banking systems. SitusAMC said corporate data such as accounting records and legal agreements was affected. How many JPMorgan customers were affected has not been stated by JPMorgan in any source we read.
Aug 2021 – Feb 2024ConfirmedOwn systems / access-control flaw
Software flaw exposes data of more than 451,000 retirement plan participants
What happened. In a filing with the Maine Attorney General reported by InvestmentNews on 1 May 2024, JPMorgan said a software issue let three system users linked to its corporate clients or their agents see plan participant data they were not entitled to. The data appeared in reports they ran between 26 August 2021 and 23 February 2024. The bank first identified the issue on 26 February 2024.
Impact. More than 451,000 retirement plan participants. Exposed data: names, addresses, Social Security numbers, and payment and deduction amounts; bank routing and account numbers for people with direct deposit. JPMorgan said it was not a cyberattack, fixed the software and offered two years of Experian IdentityWorks.
May – Jul 2021ConfirmedOwn systems / app and website
“Technology issue” lets some Chase customers see other customers’ account data
What happened. A Chase letter posted on the Montana Attorney General’s website said a technology issue between 24 May and 14 July 2021 may have let some customers see account information of other customers with similar personal information, through the mobile app or website.
Impact. Possibly exposed: names, account numbers, balances and transactions. Banking Dive noted seven Montana residents; no national total was published. Chase said it found no misuse and offered a year of Experian credit monitoring.
SitusAMC: the bank list comes from the New York Times citing people familiar with the matter. SitusAMC did not name clients, and JPMorgan only said its banking systems were not directly compromised. We do not state a JPMorgan customer count.
451,000 or 451,809? InvestmentNews reports “more than 451,000”. A more precise 451,809 appears only in secondary pages we could not trace to the filing, so we use the rounded figure.
The pattern across the record
Exposures came from access design, not intruders
Both incidents on JPMorgan’s own systems were software or display flaws that showed data to the wrong authorised users, over long periods (two and a half years in the 2024 case) before anyone noticed.
Professional-services vendors are now the leak point
A law firm and a mortgage processor held JPMorgan client data outside the bank. The bank’s own perimeter was not the weak spot in either case. JPMorgan’s 2014 intrusion predates this window and is not covered here.
What it means for JPMorgan Chase For Chase customers, JPMorgan private-fund investors and retirement plan participants — and what to do
If you received a JPMorgan or Chase breach letter, it will name the incident. These steps apply to all of them.
1.Read the letter for which incident it is
A letter about Fried Frank, SitusAMC or the plan-participant flaw says what data was involved. That decides what you need to do.
We found no confirmed hack of JPMorgan Chase’s own systems from 2016 to 2026. It has reported a 2024 software flaw that exposed data of more than 451,000 retirement plan participants, a 2021 app and website issue, and vendor incidents at the law firm Fried Frank and the mortgage vendor SitusAMC.
JPMorgan Chase data breach 2026: what happened?+
In January 2026 JPMorgan told Maine’s Attorney General that 659 investors in a private equity fund were affected after an unauthorised party copied files from a shared drive at its outside law firm, Fried Frank. Names, contact details, account numbers, SSNs and passport or ID numbers were involved. JPMorgan said its own systems were not compromised.
Was JPMorgan affected by the SitusAMC breach?+
The New York Times, cited by Reuters, reported in November 2025 that JPMorgan client data may have been accessed in the SitusAMC hack. JPMorgan said the incident did not directly compromise its banking systems. It has not published a customer count in any source we read.
What was the JPMorgan 451,000 data breach?+
A software flaw let three users tied to JPMorgan’s corporate clients see retirement plan participants’ names, addresses, SSNs and payment details in reports run from August 2021 to February 2024. JPMorgan said it was not a cyberattack and offered two years of identity protection.
Is there a JPMorgan Chase data breach settlement?+
We did not find a settlement for these incidents in the sources we read. SecurityWeek reported that the law firm Fried Frank faces lawsuits over its breach. A suit over the 2024 plan-participant exposure was also reported (via search; we did not read the filing).
More in the Breach Index
Same sourced, verification-tagged timeline, company by company — compare how peers have fared.
Independent analysis for security-leadership education; not affiliated with or endorsed by JPMorgan Chase. Facts are attributed to the dated sources above, and anything disputed or unconfirmed is labelled as such. See the full Breach Index.