Almeida Law Group is investigating a data breach at TD Bank. If you were affected, contact Almeida Law Group.
About TD Bank
TD Bank, N.A. is one of the 10 largest banks in the United States by assets, serving more than 10 million customers with retail, small business, and commercial banking products and services. It is the U.S. subsidiary of the Canadian multinational Toronto-Dominion Bank and is headquartered in Mount Laurel, New Jersey, operating approximately 1,158 branches across 15 states and Washington, D.C. TD Bank also provides private banking and wealth management services through TD Wealth. Because this breach involved financial account codes and credit and debit account information, affected customers face real risks of unauthorized account access and financial fraud.
What Happened?
TD Bank was listed in a Vermont Attorney General breach report dated September 25th, 2026. The filing identifies the incident type as a financial services data breach and reports that the categories of information involved included financial account codes and credit and debit account information. TD Bank did not provide specific dates for when this event occurred or was discovered.
A parallel disclosure made to the Massachusetts Office of Consumer Affairs and Business Regulation on September 15th, 2026 appears to relate to the same incident and identifies a broader set of exposed data types, including names, Social Security numbers, dates of birth, addresses, government-issued identification cards, Social Security cards, pay stubs, W-2s, financial account information, and credit or debit card numbers. TD Bank is offering affected customers a complimentary two-year membership to Fraud-Defender identity monitoring through Merchants Information Solutions, and has offered to help customers close affected accounts and open new ones at the bank’s expense.
This incident appears to be separate from an earlier insider breach TD Bank reported in May 2026, which involved unauthorized employee access between December 22nd, 2025 and March 11th, 2026. TD Bank has a documented pattern of insider data breaches, with prior incidents in 2023 and 2024 also involving employees improperly accessing customer data. The bank paid approximately $3.09 billion in combined penalties to the DOJ, OCC, and FinCEN, and a separate $28 million fine to the CFPB in September 2024 related to inaccurate consumer reporting. Multiple class action lawsuits are currently active against TD Bank stemming from prior insider breach incidents, including Crumpe v. TD Bank N.A., filed in February 2025 in the District of New Jersey. Several cases filed between 2023 and 2025 have been consolidated and are reportedly in active settlement negotiations as of mid-2026. No litigation specific to this September 25th, 2026 Vermont-reported incident has been identified yet.
Key Facts at a Glance
- Company or Organization: TD Bank, N.A.
- Industry: Financial Services / Banking
- Location: Mount Laurel, New Jersey
- Incident type: Data breach involving financial account and personal information
- Date of consumer notification: September 15th, 2026 (Massachusetts); September 25th, 2026 (Vermont)
- Identity theft protection offered: Two-year Fraud-Defender identity monitoring through Merchants Information Solutions
- Prior breach: Yes — multiple insider breach incidents in 2023, 2024, and 2026; $3.09 billion in combined regulatory penalties; $28 million CFPB fine
- Litigation status: Multiple active class actions, including Crumpe v. TD Bank N.A. (D.N.J., filed February 2025); consolidated cases in active settlement negotiations; no litigation specific to this incident identified yet
- Source: Vermont Attorney General breach report summary; ClaimDepot; Massachusetts AG Filing; Almeida Law Group – Prior TD Bank Investigation; Lawfold
What Should You Do?
If you received a notice from TD Bank related to this incident, enroll in the complimentary two-year Fraud-Defender identity monitoring that TD Bank is offering before any deadline communicated in your notice. Whether or not you enroll, place a fraud alert or credit freeze with all three major credit bureaus — Equifax, Experian, and TransUnion — to help block unauthorized new accounts. Review your bank and credit card statements carefully for unfamiliar transactions, and request your free credit reports at AnnualCreditReport.com to check for accounts or inquiries you do not recognize. If your Social Security number, W-2s, or pay stubs were involved, consider filing an IRS Identity Protection PIN request to guard against tax fraud. If you suspect misuse of your information, report it at IdentityTheft.gov for a personalized recovery plan.
Your Legal Rights
If your personal information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
