Almeida Law Group is investigating a data breach at U.S. Bank. If you were affected, contact Almeida Law Group.
About U.S. Bank
U.S. Bank is the primary banking subsidiary of U.S. Bancorp, a financial services holding company headquartered in Minneapolis, Minnesota. It is the fifth-largest commercial bank in the United States and the largest bank in the Midwest, operating more than 2,000 branches across 26 states and employing over 69,000 people. The bank offers a broad range of financial services, including lending, depository services, credit card services, trust and investment management, mortgage banking, and cash management, making it a custodian of highly sensitive financial and personal data for millions of customers.
What Happened?
U.S. Bank was listed in a Vermont Attorney General breach report summary filed on September 9th, 2026. According to that filing, the categories of data reported as compromised include Social Security Numbers, Financial Account Codes, and Credit and Debit Account Information. The total number of affected persons and the date of consumer notification were not specified in the filing.
The September 9th, 2026 Vermont filing may be connected to one of two significant security incidents that preceded it, though the relationship is not confirmed. Earlier in 2026, U.S. Bank was notified on May 7th, 2026 of a security incident at a third-party provider supporting its vendor, Fidelity National Information Services (FIS). U.S. Bank confirmed on May 19th, 2026 that certain credit card information was affected, and mailed notice letters around June 30th, 2026. Notably, reporting on that FIS incident indicated names, mailing addresses, and credit card numbers were involved—but not Social Security Numbers. The Vermont filing’s inclusion of Social Security Numbers and Financial Account Codes suggests this may represent a separate or expanded disclosure. Separately, on August 20th, 2026, the LockBit 5 ransomware group listed U.S. Bank as a victim on its dark web leak site, setting a September 4th, 2026 leak deadline. U.S. Bank stated publicly that this claim related to a “fourth party event” outside its own environment and that there was no evidence its systems, networks, or data repositories were compromised. LockBit never published a data sample to support its claim.
This is not U.S. Bank’s first encounter with third-party data security incidents. In October 2022, a third-party collections recovery vendor accidentally exposed the names, Social Security numbers, addresses, birthdays, closed account numbers, and outstanding balances of approximately 11,000 customers. U.S. Bank also sent breach notifications in 2025 that prompted renewed concern among customers. As of July 2026, Dapeer Law, P.A. was investigating a potential class action against U.S. Bank National Association on behalf of customers whose credit card information may have been exposed in the FIS-related incident. No filed class action lawsuit specific to the September 2026 Vermont AG filing has been identified.
Key Facts at a Glance
- Company or Organization: U.S. Bank
- Industry: Financial Services
- Location: Minneapolis, Minnesota
- Incident type: Unauthorized access or acquisition of personal financial data
- Date of consumer notification: September 9th, 2026 (Vermont AG report date)
- Data types affected: Social Security Numbers, Financial Account Codes, Credit and Debit Account Information
- Prior breach: Yes — third-party vendor incident in October 2022 (approx. 11,000 customers); FIS vendor incident disclosed May–June 2026; LockBit 5 dark web listing August 2026
- Litigation status: Potential class action under investigation by Dapeer Law, P.A. (as of July 2026) related to the FIS vendor incident; no filed suit identified for the September 2026 Vermont filing
- Source: Vermont Attorney General Breach Report; The Record; Cybernews; Dapeer Law; Cybersecurity Dive
What Should You Do?
If you believe your information was involved in this breach, take steps now to protect yourself. Enroll in any identity theft protection services U.S. Bank offers, and be sure to note any enrollment deadline. Place a fraud alert or credit freeze with each of the three major credit bureaus—Equifax, Experian, and TransUnion—to make it harder for anyone to open new accounts in your name. Monitor your existing bank and credit card accounts closely for unauthorized transactions and review your credit reports for free at AnnualCreditReport.com. Because Social Security Numbers were reported as part of the compromised data, you may also want to consider an extended fraud alert or security freeze as a longer-term precaution. If you spot any suspicious activity, report it at IdentityTheft.gov for a personalized recovery plan.
Your Legal Rights
If your personal information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
