Eastern Bank Data Breach Notice (Massachusetts Attorney General)

The exposure of your credit or debit card numbers means those specific cards remain usable for fraud until you cancel them. With 139 Massachusetts residents named in this filing, the breach is small but the risk attached to card data is immediate and practical.

Credit and Debit Card Numbers Do Not Expire Like Passwords

Eastern Bank’s June 30, 2026 filing with the Massachusetts Attorney General lists only one category of information: credit or debit card numbers. No passwords, no Social Security numbers, and no other permanent identifiers appear in the record. That is genuinely good news. The absence of those fields means this incident does not create long-term identity theft risk that follows you for years.

Card numbers, however, are different. They can be used for fraudulent purchases the moment they reach the wrong hands, and they stay valid until the card expires or is canceled. Because the filing does not state when the incident occurred, the only reliable way to know whether your cards were included is the notification letter Eastern Bank is required to send directly to affected customers. If you have not received such a letter at your last known address, it is likely your information was not part of the 139 records. Anyone who has moved since the incident should contact the bank directly to confirm their status.

What This Exposure Actually Enables

A single card number, combined with the name, expiration date, and CVV that are often stored alongside it, is enough for online or phone purchases. Criminals can test these numbers quickly at low-value merchants before moving to higher-value targets. Unlike a password, a card cannot be “changed” without issuing an entirely new one. The bank will typically send a replacement, but until that new card arrives you must treat the old one as compromised.

The record does not disclose whether the card numbers were encrypted at rest or in transit, nor does it identify the root cause. Those details remain unknown. What matters to you is that the numbers themselves are now considered exposed and must be handled as such.

Why the Scale Matters Less Than the Type of Data

Only 139 people are listed in this Massachusetts filing. That is a narrow breach compared with many others, yet the impact on those individuals is not small. When the only data exposed is payment card information, each affected person faces the same concrete risk: immediate fraudulent charges. The limited headcount does not reduce the urgency for the people whose cards were included.

How Eastern Bank Customers Should Respond Right Now

Check every recent statement for charges you do not recognize. Card issuers are usually quick to reverse fraudulent transactions, but you must spot them first. Set up transaction alerts on every card you hold with Eastern Bank so you receive a text or email for any purchase above a low threshold, such as $1. This is the fastest way to limit damage.

Contact Eastern Bank immediately to request cancellation and replacement of any card you believe may have been exposed. Do not wait for the replacement to arrive before using alerts on the new card as well. If you use these cards for recurring payments — subscriptions, utilities, insurance — update those merchants with the new card numbers as soon as they arrive.

Monitor your credit reports once in the next month, not because new accounts can be opened with card numbers alone, but to confirm no other misuse has occurred. You are entitled to one free report per year from each of the three major bureaus. The filing does not indicate that any passwords were exposed, so there is no need to change passwords for your Eastern Bank online account solely because of this incident.

Finally, treat any unsolicited calls or emails claiming to be from Eastern Bank with caution. Scammers often use news of a breach to phish for additional information. If in doubt, hang up and call the bank using the number printed on the back of your card or on their official website.

This breach is limited in scope and contains no permanent identifiers, but the exposed card numbers require prompt, practical action. The letter you may or may not have received remains the clearest signal of whether your specific records were involved. Until you hear directly from the bank or receive new cards, assume the old ones should not be used for new purchases.