Northern Trust data breach history (2016-2026): what the record shows
Northern Trust is a Chicago custody bank and wealth manager. This page records every cybersecurity incident we could tie to it from November 2016 to November 2026. The public record is short: one 2022 state filing, which appears to stem from a vendor.
Short answer
Was Northern Trust hacked?
We found no confirmed breach of Northern Trust’s own systems from 2016 to 2026 in the sources we read. We found no SEC cyber disclosure, regulator action or ransomware leak-site claim naming it.
One state filing exists. In 2022 a breach report was filed with the Massachusetts Attorney General under “Northern Trust Company” (report no. 28161). We could not open it, but search excerpts show it carries a notice from Overby-Seawell Company (via search), a Georgia firm that checks property insurance for mortgage lenders. AP reported that Overby-Seawell was hacked on 5 July 2022 and that, for KeyBank customers, names, addresses, mortgage account numbers and the first eight digits of Social Security numbers were taken. How many Northern Trust clients were affected is not public in the sources we read.
Timeline at a glance
5 Jul 2022Mortgage insurance-tracking vendor Overby-Seawell is hacked; lender client data taken. (AP via Insurance Journal)Confirmed
Aug 2022Massachusetts AG breach report no. 28161 filed under Northern Trust Company; content tied to Overby-Seawell (via search). (Massachusetts AG (via search))Reported
Last updated November 13, 2026. Every entry is dated and linked to its source; claims by attackers are labelled as claims, never stated as fact.
Northern Trust incident timeline, in detail
Confirmed = acknowledged by Northern Trust, a regulator filing or a court. Reported = credible reporting Northern Trust has not fully confirmed. Unverified claim = an attacker or leak-site claim.
Massachusetts breach report filed under Northern Trust, linked to the Overby-Seawell vendor hack
What happened. Overby-Seawell Company of Kennesaw, Georgia, tracks property insurance for banks and mortgage servicers. AP reported that hackers broke into its computers and took data on 5 July 2022. A Massachusetts AG breach report (no. 28161) is filed under Northern Trust Company; search excerpts show the document is an Overby-Seawell notice (via search). We could not open the filing itself, so we cannot state what it says about Northern Trust clients.
Impact. For KeyBank, AP reported names, addresses, mortgage account numbers and the first eight digits of the SSN. The Northern Trust count and data fields are not confirmed in any source we could read. Overby-Seawell, not Northern Trust, was the system breached.
Whose incident? Search summaries describe the August 2022 Northern Trust notice in two ways: as a breach of “the company’s computer system” and, separately, as an Overby-Seawell vendor notice. The Massachusetts document, as excerpted in search results, carries the Overby-Seawell text. We treat it as a vendor incident until the filing can be read directly.
The pattern across the record
Mortgage back-office vendors hold bank customer data
Insurance-tracking, title and servicing vendors receive mortgage files from many lenders at once. One hack at such a vendor generates notices from several banks.
A quiet record, not a guarantee
A custody bank’s main clients are institutions, whose incidents are often handled by contract rather than public notice. A thin public record means little was disclosed, not that nothing happened.
What it means for Northern Trust clients — and what to do
If you have a Northern Trust mortgage and received a 2022 letter, the data at risk was the kind used for identity fraud. For everyone else, the main risk is impersonation of the bank.
1.If your SSN digits were listed, freeze your credit
A freeze with the three US bureaus is free and blocks new-credit fraud. Partial SSNs plus a mortgage number are useful to fraudsters.
We found no confirmed breach of Northern Trust’s own systems from 2016 to 2026 in the sources we read. A 2022 Massachusetts breach report filed under Northern Trust appears, from search excerpts, to relate to a hack at mortgage vendor Overby-Seawell.
What was the Northern Trust data breach in 2022?+
A breach report filed with the Massachusetts AG in 2022 under Northern Trust Company. Search excerpts tie it to Overby-Seawell, an insurance-tracking vendor hacked on 5 July 2022. For other lenders’ customers, AP reported names, addresses, mortgage account numbers and partial SSNs were taken. The Northern Trust count is not public in the sources we read.
Was Northern Trust affected by MOVEit?+
We found no notice tying Northern Trust to the 2023 MOVEit attacks.
Is there a Northern Trust data breach settlement?+
We found none naming Northern Trust. The Overby-Seawell breach led to consolidated litigation against the vendor in Georgia (seen in search results); we did not confirm Northern Trust’s role in it.
More in the Breach Index
Same sourced, verification-tagged timeline, company by company — compare how peers have fared.
Independent analysis for security-leadership education; not affiliated with or endorsed by Northern Trust. Facts are attributed to the dated sources above, and anything disputed or unconfirmed is labelled as such. See the full Breach Index.