TD Bank data breach history (2016-2026): insider notices, the NCB vendor attack and the lawsuit
TD Bank Group (TD Bank N.A. in the US, TD Canada Trust, TD Securities) files breach notices with US states regularly. This page lists what we could source from November 2016 to November 2026, newest first, and says where we could not read the filing itself.
Short answer
Was TD Bank hacked?
We found no confirmed breach of TD’s own systems by outside attackers from 2016 to 2026 in the sources we read. TD’s disclosures describe employees who misused their access to customer data, and one vendor attack: in 2023 TD told Maine’s Attorney General that its debt-collection vendor NCB Management Services was hit by ransomware, exposing data on 15,549 TD customers.
The best-documented insider case is a former employee who accessed and shared customer information between August and December 2022; TD notified customers in early 2025, and a proposed class action followed in New Jersey. In June 2026 a security vendor reported another insider case covering 7 to 30 January 2026. In 2022 TD said a Vermont notice that drew headlines concerned two customers in an isolated employee fraud.
Timeline at a glance
15 Jun 2026Insider accessed customer data 7–30 Jan 2026, per a security vendor’s report. (UpGuard)Reported
28 Feb 2025Proposed class action filed over the 2022 employee access (D.N.J.). (Bloomberg Law)Reported
Jan–Feb 2025TD notifies customers that a former employee accessed and shared data in Aug–Dec 2022. (TechBriefly)Reported
12 May 2023TD tells Maine AG vendor NCB’s ransomware exposed 15,549 TD customers. (BeyondMachines)Reported
Sep–Oct 2022TD: Vermont notice covered two customers in an isolated employee fraud. (iTech Post)Confirmed
Last updated November 13, 2026. Every entry is dated and linked to its source; claims by attackers are labelled as claims, never stated as fact.
TD Bank incident timeline, in detail
Confirmed = acknowledged by TD Bank, a regulator filing or a court. Reported = credible reporting TD Bank has not fully confirmed. Unverified claim = an attacker or leak-site claim.
Jan 2026 (reported Jun 2026)ReportedInsider
Employee accessed customer data without authorization
What happened. UpGuard’s news page reported on 17 June 2026 that TD disclosed on 15 June 2026 an insider breach in which an employee accessed sensitive customer data between 7 and 30 January 2026. It does not cite the filing, and we could not find TD’s notice.
Impact. Per UpGuard: names, addresses, phone numbers, dates of birth, Social Security numbers, account numbers and transaction data. No count given. Treat as unconfirmed until the state filing is read.
Former employee accessed and shared customer information
What happened. TD Bank filed a notice with Massachusetts and began mailing letters in early 2025 saying a former employee may have accessed and shared customers’ personal information between August and December 2022. TD said it terminated the employee and was investigating with law enforcement. A proposed class action (Crumpe v. TD Bank, D.N.J., filed 28 February 2025) alleges TD took more than two years to notice.
Impact. Per reporting on the notice: names, contact details, dates of birth, account numbers and transaction data; at least eight Massachusetts residents. TD offered two years of fraud monitoring and help closing and reopening accounts. The total count was not disclosed. The lawsuit’s claims are allegations.
Debt-collection vendor NCB Management Services hit by ransomware
What happened. TD filed with the Maine Attorney General on 12 May 2023 after NCB Management Services, a collection agency it used, reported a ransomware attack (around 1 February 2023, per TD’s filing as seen via search) and told TD on 14 April 2023 that TD customers’ data was compromised. TD’s systems were not affected, per the filing.
Impact. Per BeyondMachines’ summary of the filing: 15,549 TD Bank customers; names, addresses, account numbers, dates of birth and Social Security numbers. Some were former customers with closed accounts. NCB’s incident affected several other lenders’ customers too.
Vermont notice: employee fraud affecting two customers
What happened. A notice TD filed with Vermont was reported in October 2022 as a broad employee data leak. TD clarified that it was a fraud case in which a bank employee accessed some customers’ account information without authorization, that the employee was dismissed, and that “our investigation determined this was an isolated incident.” iTech Post corrected its story; the original BleepingComputer report was taken down.
Impact. Per TD: two retail customers in Vermont, both fully reimbursed and offered credit monitoring.
Scale of the 2022 Vermont case: early reports described a broad leak; TD said two customers were affected. TD’s account is used here.
Several 2024–2026 TD notices appear in Massachusetts’ archive (seen via search). We could not read them, so we cannot say how many people or which incidents they cover, or whether the January 2026 insider case is among them.
The pattern across the record
Insiders with legitimate access
Every TD-originated notice we could read describes an employee or former employee misusing access to customer records. That points at monitoring of record lookups, which a 2025 lawsuit alleges was slow.
Vendors that hold collections data
The one attacker-driven event hit a debt collector, which held Social Security numbers for current and former customers.
What it means for TD Bank customers — and what to do
For TD customers the realistic risk is fraud by someone who knows your account details, not a mass hack. Letters from TD say which incident they relate to and what was involved.
1.Read the notice carefully
TD’s letters name the period and the data. If Social Security numbers were involved, act on that first.
We found no confirmed hack of TD’s own systems by outside attackers from 2016 to 2026. TD’s notices describe employees misusing access, and a 2023 ransomware attack on its debt-collection vendor NCB Management Services exposed data on 15,549 TD customers.
What was the TD Bank data breach in 2025?+
In early 2025 TD notified customers that a former employee may have accessed and shared their information between August and December 2022, including names, dates of birth, account numbers and transactions. TD fired the employee and worked with law enforcement.
Is there a TD Bank data breach lawsuit?+
A proposed class action, Crumpe v. TD Bank (D.N.J., 1:25-cv-01566), was filed on 28 February 2025 over the 2022 employee access. Its claims are allegations; we found no settlement.
Was there a TD data breach in 2026?+
A security vendor reported that TD disclosed on 15 June 2026 an employee accessing customer data between 7 and 30 January 2026. We could not find TD’s notice to confirm the details.
Was TD affected by SitusAMC or MOVEit?+
We found no reporting naming TD among the banks affected by SitusAMC (2025), Fried Frank (2025), Infosys McCamish (2023) or Chain IQ (2025). Its 2023 vendor incident was the NCB ransomware attack.
More in the Breach Index
Same sourced, verification-tagged timeline, company by company — compare how peers have fared.
Independent analysis for security-leadership education; not affiliated with or endorsed by TD Bank. Facts are attributed to the dated sources above, and anything disputed or unconfirmed is labelled as such. See the full Breach Index.