Almeida Law Group is investigating a data breach at TD Bank U.S. The breach occurred on December 22, 2025, and was discovered on March 26, 2026. If you were affected, contact Almeida Law Group.
About TD Bank U.S.
TD Bank, N.A., doing business as TD Bank U.S., is a subsidiary of The Toronto-Dominion Bank, a top 10 North American financial services company. Headquartered in Mount Laurel, New Jersey, TD Bank provides retail banking, commercial banking, wealth management, and auto finance services to over 10 million customers through approximately 1,100 branches across 15 states and Washington, D.C. The types of information compromised in this breach—including Social Security numbers, account numbers, and transactional data—are highly sensitive and can be used to commit identity theft and financial fraud.
What Happened?
TD Bank U.S. was listed in a Maine Attorney General filing reported on May 26, 2026. According to the filing and the accompanying notification letter, the incident involved insider wrongdoing: a TD Bank employee compromised personal information between December 22, 2025, and March 11, 2026. The breach was discovered on March 26, 2026, and affected consumers were notified in writing on May 22, 2026. The compromised information includes names, addresses, phone numbers, dates of birth, Social Security numbers, account numbers, and transactional data. The notification letter states that the employee’s actions caused fraudulent activity on the affected individual’s account. TD Bank offered 24 months of complimentary credit monitoring through Fraud-Defender, provided by Merchants Information Solutions, with an enrollment deadline of August 31, 2026.
This incident follows a documented pattern of insider data breaches at TD Bank. Prior incidents in 2023 and 2024 also involved employees improperly accessing customer data, leading to multiple class action lawsuits, including Crumpe v. TD Bank N.A. (filed February 2025 in the District of New Jersey), which alleges systemic failures in data security. TD Bank has also faced significant regulatory penalties in recent years, including a $28 million CFPB fine in September 2024 for inaccurate consumer reporting and approximately $3.09 billion in combined penalties from the DOJ, OCC, and FinCEN in October 2024 for Bank Secrecy Act and anti-money laundering violations.
Key Facts at a Glance
- Company or Organization: TD Bank U.S.
- Industry: Financial Services — Retail and Commercial Banking
- Location: Mount Laurel, New Jersey
- Incident type: Insider wrongdoing (employee compromise of customer data)
- Date of breach: December 22, 2025, through March 11, 2026
- Date breach discovered: March 26, 2026
- Date of consumer notification: May 22, 2026
- Total persons affected: 1
- Identity theft protection offered: 24 months of Fraud-Defender credit monitoring via Merchants Information Solutions
- Enrollment deadline: August 31, 2026
- Prior breach: Yes — multiple prior insider data breaches (2023, 2024), lost backup tapes (2012), and significant regulatory penalties (2024)
- Litigation status: Multiple class actions active related to prior insider breaches, including Crumpe v. TD Bank N.A. (D.N.J.); no litigation specific to this incident identified yet
- Source: Maine Attorney General filing; Top Class Actions — Crumpe v. TD Bank; FinCEN Penalty Announcement
What Should You Do?
If you were affected by this breach, enroll in the complimentary 24-month Fraud-Defender credit monitoring service before the August 31, 2026, deadline by visiting tdbank.merchantsinfo.com and using the enrollment code provided in your notification letter. Consider placing a fraud alert or credit freeze on your credit files with Equifax, Experian, and TransUnion to help prevent unauthorized accounts from being opened in your name. Regularly review your bank account statements and credit reports for any unauthorized activity. You can obtain free credit reports at AnnualCreditReport.com. If you suspect identity theft, report it to the FTC at IdentityTheft.gov and to your local law enforcement.
Your Legal Rights
If your personal information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
