Bank of America bankofamerica.com Bank of America data breach (2020): what happened and what to do
On April 22, 2020, Bank of America uploaded small business loan application data to a Small Business Administration test platform where other lenders and vendors could see it. The bank said it affected a small number of clients.
View all 13,115 breaches- Breach date
- 22 Apr 2020
- Made public
- 18 May 2020
- Data exposed
- Names, Physical addresses, Social security numbers, Phone numbers, Email addresses
- Last updated
Bank of America disclosed a data exposure tied to the Paycheck Protection Program (PPP), the federal small business loan program launched during the COVID-19 pandemic. The incident happened on April 22, 2020, and the bank's notice was filed with the California attorney general in May 2020.
What happened
According to news coverage of the bank's notice, Bank of America uploaded PPP application data to a test platform run by the U.S. Small Business Administration (SBA). Other SBA-authorized lenders and their vendors could have viewed it there. The bank said the data was quickly removed and that it sought and confirmed the deletion the same day.
Bank of America didn't say how many clients were affected, describing it only as a small number. It said it found no indication that other lenders or their vendors viewed or misused the information.
What was exposed
Reports on the notice describe business details such as tax identification numbers and addresses, plus owner information: names, home addresses, Social Security numbers, phone numbers, email addresses and citizenship status. The exact items depend on what each applicant submitted.
For a small business owner, that is a complete identity kit. A Social Security number plus a home address and phone number is enough to open credit, file a fraudulent tax return or take over an account. A business tax ID can be misused to apply for loans in the company's name.
What Bank of America did
The bank notified affected clients and offered two years of free identity theft protection and credit report monitoring. It stated that the information was removed from the test site.
Who should pay attention
If you applied for a PPP loan through Bank of America in April 2020, check your mail for the bank's letter. If you got one, take the offered monitoring and enroll before the deadline in the letter. If you didn't, this incident most likely didn't involve you.
The exposure was to other lenders and their vendors, not a public posting. That limits the realistic risk, but a Social Security number can't be changed, so a credit freeze is the safe default for anyone whose number was in the file.
Why a Social Security number is the problem
A bank password can be reset in minutes. A Social Security number stays the same for life, and lenders, the IRS and employers all rely on it to confirm who you are. That's why an exposure that reached only other lenders still deserves a credit freeze, an IRS Identity Protection PIN and a quick look at your credit reports a couple of times a year, even if nothing looks wrong today.
What to do if you were in it
- 1
Freeze your credit at all three bureaus
A freeze stops anyone from opening new credit in your name. It's free and takes about 10 minutes each at Equifax, Experian and TransUnion. You can lift it temporarily when you apply for credit yourself.
- 2
Take the free monitoring
If you received a notice, enroll in the two years of identity theft protection and credit monitoring Bank of America offered, using the instructions in the letter.
- 3
Claim your IRS identity protection PIN
With a Social Security number in play, an Identity Protection PIN from the IRS stops anyone else from filing a tax return in your name. You can get one on irs.gov.
- 4
Watch your business and personal accounts
Check statements and credit reports for loans or accounts you didn't open. Under U.S. law you get a free report weekly at annualcreditreport.com.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan to see which breaches include your email address or phone number. Serus monitors breach databases and the dark web and alerts you when your data turns up, but it can't remove data that's already in a breach, so the alerts tell you what to change.
Frequently asked
Was I affected by the Bank of America PPP breach?
Bank of America said a small number of clients were affected and notified them directly. If you didn't get a letter, you're most likely not included.
What was exposed?
Reports on the notice list business tax IDs and addresses and owner details including names, home addresses, Social Security numbers, phone numbers, email addresses and citizenship status.
Was the data stolen or published?
The bank said the data was visible to other SBA-authorized lenders and their vendors on a test platform, and that it found no indication it was viewed or misused.
Is there a settlement?
The sources for this page don't mention one.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
