TD Bank Data Breach: 2025 Incident and What to Do

Updated October 2026: this page now rests on state breach filings and court records. We removed the earlier claim of a single February 2025 breach, added TD Bank's April 2025 and 2026 filings with the Vermont attorney general, and corrected the Meta pixel case, which was dismissed in June 2025 but continues after a June 30, 2026 ruling.

TD Bank has not disclosed one large breach. Its public state filings describe a series of small insider cases: a former employee who accessed customer data between August 9 and December 11, 2024 (including Social Security numbers, per a notice filed with Vermont in April 2025), plus further filings in 2026. If you got a letter, freeze your credit at all three bureaus, accept the free monitoring, and review your statements. Vendor risk is a separate category from insider access; file-transfer tools such as MOVEit are one example of third-party software that banks and their suppliers rely on. One plaintiffs' law firm published an investigation into this supply chain failure at a TD vendor in 2023, and its figures are the firm's account, not a confirmed count. Regulators do penalize banks over data handling in general: coverage of data security failures at Morgan Stanley is an example from another firm, unrelated to TD.

If you bank with TD or have TD as a creditor, the practical steps are simple: freeze your credit at all three bureaus, enroll in identity monitoring, review the notice you received, and enable account alerts. Below is what the public record shows about TD's incidents, the lawsuit status, and what to do regardless of whether you were directly affected. If your identity was already misused, read how to file an identity theft affidavit and the federal recovery steps at IdentityTheft.gov.

Quick reference: TD Bank security incidents 2024-2026

What is verified about TD Bank's data breaches?

The public record is a set of state filings, not one headline event. Each Vermont filing counts only Vermont residents, and the records we read give no national total, so the full number of affected customers is not public.

Employee-accessed data: TD's April 2025 notices say a former employee improperly accessed customer information. TD calls the incidents isolated and says an internal investigation by its corporate security team is under way. The sample letters list names, addresses, phone numbers and account numbers, and in the August to December 2024 case also dates of birth, Social Security numbers and debit card numbers.

Data exposed: Social Security numbers appear in the 2024 case and in TD's August 2026 filing, which also lists government ID numbers. The September 2026 filing lists account and card information only.

Notification process: In the sample letters, TD offers a complimentary two-year Fraud-Defender membership (provided by Merchants Information Solutions) and says it will cover the costs of closing and reopening accounts. The notice text states TD "believe[s] this was the cause of the fraudulent activity" on the affected accounts in the 2024 case.

If you received a notification letter, TD has told you your information was involved. If you did not, your data may still sit in a vendor or partner system, so keep the steps below in place. Business owners carry a second-order risk once Social Security and tax IDs are exposed, since criminals reuse them on fraudulent filings, so many firms now run TIN matching to confirm a payee's name and taxpayer ID agree before releasing payments.

What should you do if you bank with TD?

Five steps that take roughly 30 minutes:

1. Freeze your credit at all three bureaus: Free since 2018. Equifax, Experian, and TransUnion. A freeze blocks new accounts being opened in your name. It is the strongest single defense against identity theft.

2. Enroll in TD's offered identity monitoring: If you received a notification letter, the Fraud-Defender offer is free for two years. Activate it using the code in your letter.

3. Check whether you are eligible for any claim or settlement: No settlement fund for these incidents appears in the records we reviewed, so treat any site promising a payout with caution and confirm it through TD or a court docket first. If you can show a direct fraud loss, dispute it with TD in writing.

4. Enable account alerts on TD accounts: Real-time notifications for transactions over a threshold, login attempts, and address changes.

5. Review credit reports for unauthorized accounts: Free at annualcreditreport.com. Check all three bureaus.

If you are not a TD customer but had your data shared with TD (e.g., loan applications), the same steps still apply. Identity theft does not check whether you currently bank with the entity that reported the incident. Our data breach response plan template shows how a business should structure the same response for its own customers.

Dupple data: As of October 15, 2026, Toolradar tracks 37 password managers. A bank notice does not expose your passwords, but phishing often follows a breach, and a unique password per account limits the damage. Start with our best password managers guide, or the free options if cost is the barrier.

What changed in 2025-2026 for breach notification?

State law sets the notification deadline, and it varies by state. The attorney general filings above are the public record of what TD reported and when: the May 2024 access was reported to Vermont in April 2025, and the August to December 2024 access was reported in the same month.

Massachusetts' 2014 settlement with TD ($625,000 over backup tapes lost in 2012) is the older precedent for how a state treats notification timing. It concerned a different incident and different systems.

The CFPB's September 2024 $28 million order on TD is a separate compliance matter about credit reporting accuracy. It does not relate to the data incidents in the filings above.

What are the common misconceptions about bank breaches?

Two patterns I see:

1. "Banks are immune to breaches because of regulation": TD has filed several incident notices in the past two years. Regulation creates penalties for breaches but does not prevent them.

2. "Class actions pay out a lot": Payouts vary widely, and many privacy cases are dismissed or settle for modest amounts per person. Document everything if you do experience fraud after a breach.

The honest framing: act on the notice you received, and focus on credit freezes and monitoring, which provide more value than any settlement check.

What about the Meta pixel case?

Separate from the insider incidents, a class action (Stevens v. TD Bank) alleges TD shared customer data with Meta through tracking pixels on TD's website. These are the plaintiff's allegations, and TD has contested them. On June 27, 2025, the federal court in New Jersey dismissed the complaint without prejudice and allowed the plaintiff to amend it. The plaintiff filed amended complaints, and on June 30, 2026 the court denied TD's motion to dismiss in part and converted the rest to a motion for summary judgment. In August 2026 the court ordered revised discovery limited to the issue of consent (all per the public docket). The docket records no settlement.

The Meta pixel issue is a real privacy question across many banks and websites in 2026. Most pixel-based privacy class actions either settle for low amounts or get dismissed, but this one is still active.

How do you assess any bank breach?

Three questions to ask:

1. What data was exposed?: SSN plus financial account details is the most dangerous combination. Identity theft risk is highest.

2. How long between discovery and notification?: Long delays signal poor incident response. Affected customers had less time to protect themselves.

3. What remediation is offered?: Free credit monitoring is standard. Identity restoration services are stronger. Cash payments via class action are typically last and small.

Apply these to TD's 2024 insider case: SSN plus account and debit card data was exposed (high risk), the notice went out in April 2025 after activity between August and December 2024 (review the dates against your own letter), and two years of credit monitoring plus account reimbursement were offered (standard remediation).

FAQ

Was TD Bank breached in 2025?

TD filed notices in April 2025 with the Vermont attorney general about former-employee access to customer data in 2024, including Social Security numbers in one case. We found no filing that describes a single February 2025 breach. See the Vermont breach list for TD's later 2026 filings.

What should I do if I am a TD Bank customer?

Freeze your credit at Equifax, Experian, and TransUnion (free). Enroll in any identity monitoring TD offered. Enable account alerts. Review credit reports for unauthorized accounts and report fraud through IdentityTheft.gov.

Is there a TD Bank data breach settlement I can claim?

No settlement for the insider incidents appears in the state filings or court records we reviewed. Be wary of sites that promise a payout, and document any unauthorized activity so you can dispute it with TD.

Did TD Bank share my data with Meta?

A class action (Stevens v. TD Bank) alleges so. The court dismissed the first complaint in June 2025 with permission to amend, and the case continued after a June 30, 2026 ruling. TD has not been found liable, and the allegations remain unproven.

Is TD Bank safe to bank with after these incidents?

The filings describe individual insider access, not a systemwide external compromise. Deposits at an FDIC-insured bank are protected up to $250,000 per depositor, per bank, per ownership category. The risk from exposed data is identity theft, not loss of deposits. Take the protective steps above regardless of which bank you use.

How many people were affected?

No national total is published in the records we reviewed. The Vermont filings count one, two, five and five Vermont residents, which reflects only Vermont. Check your own letter for the specifics that apply to you.

Stop overpaying for AI tools you barely use. See how Dupple X helps your team adopt AI without the bloat.