TD Bank discloses new data breach affecting Massachusetts customers

TD Bank, the U.S. retail banking arm of Toronto-Dominion Bank, disclosed a data breach that may have exposed customers’ personal and financial information, according to a notice filed with the Massachusetts Office of Consumer Affairs and Business Regulation.

The bank said it recently discovered a data security event that may have resulted in unauthorized access to or disclosure of certain personal information in its possession, though it did not provide specific dates for when the event occurred or when it was discovered. The notice identified 54 Massachusetts residents as affected; TD Bank has not disclosed how many customers were affected nationwide.

The bank said the information potentially exposed included names, Social Security numbers, dates of birth, current and prior addresses, government-issued identification cards, Social Security cards, pay stubs, W-2 forms, financial account information and credit or debit card numbers.

TD Bank is offering affected customers a complimentary two-year membership to Fraud-Defender, an identity monitoring service provided by Merchants Information Solutions, which customers can activate using enrollment steps included in their notification letter or by calling the company’s customer service line, available Monday through Friday from 8 a.m. to 7 p.m. Eastern time.

The bank also said it would help customers close existing accounts and open new ones at no cost, and recommended that customers set up passwords on their accounts, regularly change online passwords and security questions, review account statements, and monitor their credit reports over the next 12 to 24 months. Customers can report suspicious activity or suspected identity theft to the bank by phone.

The disclosure comes after a separate, earlier TD Bank data breach reported in February 2025, in which a former employee gained unauthorized access to customer information between August and December 2022. That incident, also disclosed to Massachusetts regulators, affected at least eight Massachusetts residents, though the total number of people affected nationwide was not disclosed. TD Bank said it terminated the employee responsible and worked with law enforcement and its corporate security team to investigate.

Shamis & Gentile, a law firm specializing in data breach class actions, said it is investigating the current TD Bank breach.