State Street is one of the largest custody banks, holding assets and paying benefits for pension funds and other institutions. This page records the incidents since 2016 that exposed data it handles, what is confirmed, and what clients and their members should do.
Short answer
We found no confirmed breach of State Street’s own systems from 2016 to 2026 in the sources we read. The main incident was at a vendor: Fiserv, which clears and processes physical checks for State Street, told State Street on 16 October 2023 that check information had been exposed through its MOVEit file-transfer application, breached in the May 2023 MOVEit campaign.
The exposure reached State Street’s institutional clients’ payees. The Los Angeles County Employees Retirement Association (LACERA), a State Street custody client, said about 2,400 retirees and beneficiaries paid by check were affected, plus about 200 other payees. State Street also filed notices in Massachusetts about documents or files sent to the wrong recipient in 2023 and 2025 (via search).
Last updated November 13, 2026. Every entry is dated and linked to its source; claims by attackers are labelled as claims, never stated as fact.
Confirmed = acknowledged by State Street, a regulator filing or a court. Reported = credible reporting State Street has not fully confirmed. Unverified claim = an attacker or leak-site claim.
What happened. A 2025 State Street notice on file with Massachusetts says a data file was sent in error (via search; we could not open it).
Impact. Names, addresses and bank account information, per the search snippet. Number of people not known to us.
What happened. Per LACERA, “Fiserv notified State Street on October 16, 2023, that it had identified check information exposures through its transfer application, MOVEit.” Fiserv provides State Street’s physical check deposit clearing and processing. State Street investigated which clients were affected, told LACERA on 27 October and gave member details in December 2023. LACERA said its own systems were not compromised. It was the vendor’s systems.
Impact. LACERA: about 2,400 retirees, survivors, beneficiaries and legal-split payees paid by check, plus about 200 other payees; two years of Kroll monitoring. State Street’s own notice (via search) says check images may show payee name, address, phone and sometimes bank account and routing numbers, and in limited cases handwritten driver’s licence numbers, dates of birth or SSNs. Total across all State Street clients not published.
Sources: LACERA press release, 5 Jan 2024 · State Street Massachusetts notice 2024-225 (via search)
What happened. A State Street notice says an employee scanned two documents meant for separate clients together and the application was emailed to another client (via search; we could not open the letter).
Impact. Number of people and data types not known to us.
The one sizeable incident was at Fiserv, a check processor. The others were documents or files sent to the wrong recipient. None involved an intruder in State Street’s own network, per the sources we read.
Fiserv told State Street, State Street told its pension-fund clients, and they told their retirees, about three months after Fiserv’s notice. Each hop adds delay.
In 2008 State Street disclosed that a vendor-held hard drive with data on about 45,000 people from its Investors Financial Services acquisition had been stolen in 2007 (via search). It is before this page’s window.
Most people affected by State Street incidents are not its direct clients: they are pension members or payees of funds State Street serves. If you got a letter from your pension fund naming State Street or Fiserv, your check details may have been exposed.
LACERA noted that members paid by direct deposit were not affected. Check images carry account and routing numbers.
Ask your bank about check fraud alerts or a new account number if routing and account numbers were exposed.
Freeze your credit and get an IRS IP PIN.
SSN exposure action planAsk your custodian which subcontractors handle member data and how fast they must tell you about a breach.
Vendor Risk ScorecardThe Fiserv exposure reached LACERA through State Street. Map who notifies whom and how long each hop may take.
Third-party breach checklistPractise scoping what a processor held and what you must tell regulators and members.
Vendor breach labState laws and contracts set different clocks; a long vendor chain eats them.
Notification clock calculatorCompany statements and regulator filings first, then reputable reporting. Reviewed November 13, 2026.
We found no confirmed breach of State Street’s own systems from 2016 to 2026. Its check-processing vendor Fiserv exposed check images through the 2023 MOVEit breach, which affected payees of State Street clients such as LACERA.
Fiserv, which clears and processes physical checks for State Street, told State Street on 16 October 2023 that check information was exposed through its MOVEit application. State Street then notified affected institutional clients.
Check images, which can show payee name, address, phone and bank account and routing numbers, and in limited cases handwritten SSNs, dates of birth or driver’s licence numbers, per State Street’s notice (seen via search).
State Street has not published a total. LACERA alone reported about 2,400 retirees and beneficiaries plus about 200 other payees.
Same sourced, verification-tagged timeline, company by company — compare how peers have fared.
Bribed support agents, 69,461 customers, an 8-K.
4.4M people via a third-party support app (2025).
Social engineering and cloud platforms.
No confirmed breach; 2024 vendor ransomware in Japan
Or see the full Breach Index and how to read it.
Independent analysis for security-leadership education; not affiliated with or endorsed by State Street. Facts are attributed to the dated sources above, and anything disputed or unconfirmed is labelled as such. See the full Breach Index.