Almeida Law Group is investigating a data breach at Bangkok Bank PCL – New York Branch. The breach occurred on September 17th, 2025. If you were affected, contact Almeida Law Group.
About Bangkok Bank PCL – New York Branch
Bangkok Bank Public Company Limited is a Thai commercial bank founded in 1944 and publicly traded on the Stock Exchange of Thailand. It manages approximately $130 billion in total assets, employs over 20,000 people, and operates more than 800 domestic branches and 32 international branches across 15 economies. The New York Branch, located at 29 Broadway, 19th Floor, New York, NY 10006, is a US federally chartered wholesale bank primarily engaged in funds transfer and dollar clearing activities. The breach did not originate at Bangkok Bank’s own systems; it occurred at Mercadien, P.C., a Hamilton, New Jersey-based CPA and advisory firm that provided audit services to the Branch.
What Happened?
Bangkok Bank PCL – New York Branch was listed in a California Attorney General sample breach notice filed in connection with a data security incident at its third-party audit firm, Mercadien, P.C. An unauthorized person accessed and acquired data from Mercadien’s network between September 17th, 2025 and October 9th, 2025. Mercadien discovered the intrusion on November 7th, 2025. The Branch states it was informed on August 12th, 2026 — approximately nine months after Mercadien’s discovery — that personal information it had shared with Mercadien in connection with audit services may have been affected. Consumer notification letters were mailed on November 3rd, 2026. The information potentially compromised includes names, addresses, dates of birth, and Social Security numbers. Bangkok Bank reports no evidence that any personal information has been misused. The broader Mercadien breach is estimated to have affected approximately 402,760 individuals across multiple banking clients. No ransomware group has publicly claimed responsibility for the intrusion.
Class action litigation has been filed against Mercadien, P.C. in New Jersey federal court. The initial case, Delgado v. Mercadien, P.C., CPAs (3:26-cv-01773), was filed on February 23rd, 2026 and has since been consolidated with more than a dozen similar cases under the caption In re Mercadien, P.C., CPAs. On October 6th, 2026, the court allowed limited discovery ahead of a planned December 4th, 2026 mediation. No class action specifically naming Bangkok Bank PCL – New York Branch has been identified. It is also worth noting that Mercadien had a prior, separate breach: The Mercadien Group, LLC notified 327 individuals in June 2025 of a breach that occurred on November 26th, 2024 and was discovered April 29th, 2025.
Key Facts at a Glance
- Company or Organization: Bangkok Bank PCL – New York Branch
- Industry: Banking / Financial Services
- Location: 29 Broadway, 19th Floor, New York, NY 10006 (Parent: Bangkok, Thailand)
- Incident type: Unauthorized network access at third-party vendor (Mercadien, P.C.)
- Date of breach: September 17th, 2025
- Date breach discovered: November 7th, 2025
- Date of consumer notification: November 3rd, 2026
- Identity theft protection offered: 24 months of free credit monitoring through IDX
- Enrollment deadline: February 3rd, 2027
- Prior breach: Mercadien Group, LLC reported a separate breach in June 2025 (incident date November 26th, 2024; discovered April 29th, 2025)
- Litigation status: Consolidated class action In re Mercadien, P.C., CPAs pending in New Jersey federal court (lead case Delgado v. Mercadien, 3:26-cv-01773, filed February 23rd, 2026); no litigation specifically naming Bangkok Bank NY Branch found
- Source: California AG Breach Report | MA AG Breach Notice | Mercadien PC Data Breach – ForThePeople | Mercadien Data Breach – ClaimDepot | Delgado v. Mercadien – CourtListener | Mercadien Data Breach: Bank Auditor Hit 402,760 – CloudSkope
What Should You Do?
If you received a notice from Bangkok Bank PCL – New York Branch, you should enroll in the 24 months of free credit monitoring offered through IDX at app.idx.us/account-creation/protect using the unique code provided in your letter. The enrollment deadline is February 3rd, 2027. Because Social Security numbers and dates of birth were among the data types potentially exposed, you should also consider placing a fraud alert or security freeze on your credit files with Equifax, Experian, and TransUnion. Review your credit reports for free at AnnualCreditReport.com and monitor your financial accounts for any unfamiliar activity. If you spot signs of fraud or identity theft, visit IdentityTheft.gov for step-by-step guidance on what to do next.
Your Legal Rights
If your personal information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
