If you were affected, free legal review is available — no obligation.
Learn how to participate in the class action and what compensation you may be entitled to.
Join the Class Action →Use our verification tool to confirm your letter matches this official AG filing.
Verify My Notice LetterThis case file references a public filing made with the state filing in MA. This website is not affiliated with, endorsed by, or operated by any state government agency.
U.S. Bank was the subject of a data breach notification filed with the MA Attorney General. The AG filing was recorded on April 28, 2026.
From the AG filing description
U.S. Bank operates as one of the preeminent financial institutions in the United States, providing a comprehensive suite of banking, investment, mortgage, trust, and payment services to millions of consumer and commercial clients. Because of its central role in the modern financial ecosystem, U.S. Bank routinely collects, processes, and stores vast quantities of high-value, highly sensitive personal and financial information. This repository includes not only everyday checking and savings account details, but also complex wealth management profiles, loan applications, credit histories, and deeply private transactional data necessary to facilitate modern commerce and financial security. The 2026 security incident reported to the Massachusetts Attorney General highlights the escalating vulnerabilities inherent in large-scale financial data management. While the exact vector of the breach continues to be evaluated, incidents affecting major banking institutions typically involve sophisticated cyberattacks, vulnerabilities in digital banking portals, unauthorized intrusion into centralized customer databases, or compromised third-party vendor systems. In the financial sector, threat actors increasingly target legacy network infrastructure and integrated software platforms designed to handle massive volumes of sensitive customer records, seeking to extract lucrative personal and banking credentials. The exposure resulting from this breach places affected consumers at grave risk of severe financial and identity-related harms. Because the compromised records likely contain a combination of full names, Social Security numbers, financial account numbers, routing numbers, and detailed transaction histories, bad actors are uniquely equipped to execute fraudulent account takeovers, unauthorized wire transfers, and synthetic identity theft. Unlike transient retail data leaks, the compromise of core banking and financial identifiers allows malicious actors to establish fraudulent credit lines, intercept tax filings, and drain personal savings accounts, creating long-lasting financial devastation for victims who must spend years untangling the damage. As a federally regulated financial institution, U.S. Bank is bound by stringent legal and regulatory mandates designed to safeguard consumer data, chief among them the Gramm-Leach-Bliley Act (GLBA), federal FTC safeguarding regulations, and state-level consumer protection statutes. These laws impose affirmative duties on financial entities to maintain robust administrative, technical, and physical safeguards, conduct regular risk assessments, and encrypt sensitive data both in transit and at rest. The occurrence of a significant data breach strongly indicates a failure in these mandatory security protocols, suggesting that institutional negligence or lax oversight directly facilitated the unauthorized extraction of private consumer files. Receiving a data breach notification letter from U.S. Bank serves as formal legal acknowledgment that your private financial information was compromised due to corporate negligence, instantly granting you the legal standing necessary to participate in a class action lawsuit. Class members do not need to prove that they have already suffered actual financial theft or out-of-pocket losses to seek accountability and compensation; the increased risk of future identity theft and the forced mitigation efforts are legally actionable injuries. Our firm handles these complex data privacy cases on a strict contingency fee basis, meaning you pay absolutely nothing out of pocket, and we only collect a fee if we successfully recover compensation on your behalf. Given the massive scale, institutional reach, and systemic importance of U.S. Bank, this 2026 data breach represents a critical failure in the financial sector's duty to protect consumer trust. When a major banking institution stumbles in its cybersecurity obligations, the fallout impacts thousands of individuals who trusted the bank with their life savings and most private identifiers, making robust legal accountability an absolute necessity.
Under the Massachusetts Data Security Law (201 CMR 17.00), you may have a legal claim against U.S. Bank if any of the following apply:
Based on the data types reported in this filing:
Your SSN is the master key to your identity. Once exposed, criminals can open new lines of credit, take out loans, or file taxes in your name.
Combined with a name and other leaked data, date of birth helps criminals pass identity verification questions at banks and government agencies.
Common categories of compensation in data breach class actions
Courts recognize that the time spent monitoring accounts, placing credit freezes, and dealing with the aftermath of a breach has real economic value. This category of damages is recoverable even without direct financial loss.
Professional credit monitoring services cost $10–$40 per month. Identity theft restoration services, if needed, can cost hundreds of hours and thousands of dollars. Courts have awarded these costs as direct damages in SSN breach cases.
Direct financial losses resulting from the breach — unauthorized charges, fraudulent transfers, or fees incurred through fraud — are recoverable as compensatory damages. Banks may reverse some charges; a class action recovers the remainder and associated costs.
Several state data breach laws provide for statutory minimum damages — fixed amounts recoverable per affected individual regardless of actual loss. These provisions exist specifically to make legal action viable for victims who have not yet experienced direct harm.
Note: an attorney general breach filing does not by itself establish a settlement fund, a payment amount, or a claim deadline. If an official settlement notice is later issued, rely on that notice for payment details and deadlines.
No. Under Massachusetts Data Security Law (201 CMR 17.00) and federal law, the unauthorized exposure of your personal data — regardless of whether it has been actively misused — can be sufficient grounds for a claim. The breach itself is the injury.
Nothing. The Law Office of David S. Harris handles data breach cases on contingency — you pay zero upfront and owe nothing unless compensation is recovered.
Immediately place a free credit freeze at all three bureaus (Equifax, Experian, TransUnion). A freeze blocks new accounts from being opened in your name. Then file a complaint with the FTC at IdentityTheft.gov and contact our office — SSN exposure is one of the most serious breach types.
Banks may reverse fraudulent charges, but they are not obligated to compensate you for time lost, stress, or indirect damages. A class action claim against the breached company can recover those additional categories of harm.
State statutes of limitations for data breach claims typically run 2–4 years from the date of the breach or its discovery. Because this breach was recently disclosed, the window is open — but acting early preserves your options and strengthens the case.
Accepting free credit monitoring from U.S. Bank does not waive your right to pursue legal action unless you signed a specific release waiving claims. In most cases, victims who accepted monitoring can still file.
Not necessarily. Many data breach victims are never notified directly. If your personal information was held by U.S. Bank during the relevant period, you may still qualify even without receiving a letter. A free eligibility review can confirm your status.
Applicable State Law
This breach was reported under the Massachusetts Data Security Law (201 CMR 17.00), which mandates notification and establishes your right to seek damages.
U.S. Bank breach?
Free case review · No fee unless you win