TD Bank data breach: Vermont AG confirms notice involving SSNs and accounts

On August 13, 2026, TD Bank U.S. filed a security-breach notice with the Vermont Attorney General’s Office. The AG’s public summary lists five Vermont residents and these categories of data: Social Security numbers, government ID numbers, financial account codes, and credit and debit account information.

The published table does not include an incident date, how the data was exposed, or any total outside Vermont. TD Bank has not posted a statement about this filing. The AG notes that the Vermont resident count “may go up as companies determine the total number of impacted residents.”

What the headlines skip

Most pages about this lead with the bank’s name, as if a large public hack had been announced. That is not what the record shows. Vermont posted a summary of a notice the bank was required to file. It counts five Vermont residents. It does not describe an attack. The bank has said nothing on its own site. No major news organization has reported it. The other write-ups repeat the same AG table, often to offer a lawsuit signup.

Two common readings both miss the point for a customer. One is “only five people, so ignore it.” Vermont counts only Vermont residents, and the AG says that number may rise. Other states are not in this table. Five is not an all-clear. The opposite reading treats a legal-lead page as proof the whole bank was emptied out. Those sites are looking at the same one-line filing you can already see.