M&T Bank data breach

What we know

M&T Bank operates as a major regional financial institution providing comprehensive banking, mortgage lending, wealth management, and commercial financial services to millions of customers across the United States. Because of its core operations, the bank collects, processes, and stores vast quantities of high-value personal and financial data. Customers entrust M&T Bank with sensitive credentials, account numbers, and identifying details necessary to facilitate everyday transactions, secure loans, and manage investments. This concentration of lucrative financial information makes the institution and its digital infrastructure a prime target for malicious actors seeking to exploit systemic vulnerabilities for economic gain. In 2025, M&T Bank formally reported a data security incident to the Massachusetts Attorney General, signaling a breach that compromised sensitive consumer information. While the precise vector of the incident is still under investigation, breaches affecting financial institutions typically involve unauthorized access to internal databases, compromise of third-party vendor platforms, or sophisticated cyberattacks designed to bypass perimeter defenses. Financial sector breaches often exploit complex digital supply chains or legacy software vulnerabilities, allowing unauthorized parties to infiltrate networks and siphon confidential records before detection occurs. According to preliminary disclosures, the incident exposed a dangerous combination of personally identifiable information and core financial data. Exposure of full names, Social Security numbers, dates of birth, and financial account numbers creates an immediate and severe risk of identity theft and unauthorized account takeovers. When malicious actors obtain bank account and routing numbers alongside government identifiers, they can execute fraudulent wire transfers, drain savings accounts, open unauthorized lines of credit in the victim's name, and disrupt long-term financial stability. The depth of this data exposure leaves affected individuals uniquely vulnerable to multi-layered financial fraud. As a financial institution, M&T Bank is bound by stringent regulatory frameworks, most notably the Gramm-Leach-Bliley Act (GLBA) and applicable state consumer protection laws. These legal standards mandate that financial entities implement robust administrative, technical, and physical safeguards to protect nonpublic personal information. The occurrence of a data breach of this magnitude strongly indicates a failure to maintain adequate cybersecurity protocols, potentially violating statutory duties to monitor networks, encrypt sensitive data, and secure third-party integrations against foreseeable threats. Receiving an official data breach notification letter from M&T Bank serves as formal legal admission that your confidential records were compromised due to corporate negligence. This notification establishes the legal standing necessary to participate in a class action lawsuit aimed at holding the institution accountable. Affected consumers are not required to show immediate out-of-pocket financial loss to seek compensation for the increased risk of identity theft, lost time, and emotional distress. Our firm handles these complex consumer privacy cases on a contingency fee basis, meaning you pay nothing out of pocket and we only collect a fee if we successfully recover compensation on your behalf.

See every breach reported in Massachusetts or read what to do after a ransomware attack.