TD Bank td.com TD Bank data breach: what happened and what to do
TD Bank lost two unencrypted backup tapes in March 2012 while they moved between its Massachusetts offices. It began notifying about 267,000 customers in October 2012. Reported data included names, addresses and Social Security numbers, sometimes account and driver's license numbers.
View all 13,115 breaches- Breach date
- Mar 2012
- Made public
- 12 Oct 2012
- Affected
- 267,000
- Data exposed
- Names, Physical addresses, Social security numbers, Bank account numbers, Driver's licenses
- Last updated
What happened
In March 2012, TD Bank lost two unencrypted server backup tapes while a third-party courier moved them between its offices in Haverhill and Springfield, Massachusetts. The bank searched for the tapes and didn't tell customers until October 2012, almost seven months later, according to SC Media. It said it wanted to finish its investigation first.
TD Bank began notifying about 267,000 customers nationwide. The data on the tapes included names, addresses and Social Security numbers, and in some cases account numbers and driver's license numbers. The bank offered one year of free credit monitoring.
The date on our breach list, 2013, is when the notice shows up in state records. The loss itself happened in 2012.
The settlements
Massachusetts's attorney general settled with TD Bank for $625,000 in 2014, as NECN reported. A group of nine state attorneys general later reached a separate settlement that included $850,000 and commitments to encrypt backup tapes, according to a Ropes & Gray summary.
What it means for you now
No one has said the tapes were found or misused. But a Social Security number doesn't change, so data from 2012 is still useful to a criminal in 2026. If you got a letter from TD Bank, a credit freeze is the lasting fix.
What to do if you were in it
- 1
Freeze your credit
A Social Security number can't be replaced easily. A free freeze at Equifax, Experian and TransUnion stops most new accounts in your name.
- 2
Check your credit reports
Get your free reports at annualcreditreport.com and look for accounts you didn't open.
- 3
Watch your accounts and ask about new numbers
If an account number was on your letter, ask TD Bank about monitoring or replacing it.
- 4
Be wary of messages about the loss
Scammers use old breaches as a hook. Contact TD Bank using a number from your card or statement.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan to see which breaches include your email or phone.
Frequently asked
Was I affected by the TD Bank data breach?
TD Bank notified about 267,000 customers in October 2012 by letter. If you didn't get one, you were probably not on the tapes, but ask the bank.
What was exposed?
Reported data included names, addresses and Social Security numbers, and in some cases account numbers and driver's license numbers.
Is there a settlement?
State attorneys general settled with TD Bank in 2014 (Massachusetts for $625,000, a nine-state group for $850,000). Those were payments to the states, not to customers.
Should I freeze my credit?
Yes, if your Social Security number was included. It's free and you can lift it any time.
Sources
- scworld.com/six-months-after-backup-tapes-go-missing-td-bank-alerts-customers/article/263086/
- necn.com/news/local/massachusetts/td-bank-to-pay-625k-to-address-data-breach/191529/
- ropesgray.com/en/insights/alerts/2014/12/state-attorneys-general-data-privacy-settlement-with-td-bank-requires-encryption-of-sensitive-data
Something wrong or out of date? Tell us and we'll re-check it.
