Commonwealth Trust Company suffered a targeted data breach in May 2025 when an unauthorized actor gained access to an employee’s email account. The breach exposed highly sensitive personally identifiable information (PII) and protected health information (PHI), including names, Social Security numbers, medical records, treatment details, prescription data, insurance numbers, bank account information, and dates of birth. The compromised data belonged to at least seven Massachusetts residents, though the full scope of affected individuals remains under review. The incident was detected promptly, triggering an internal investigation that concluded in August 2025. While the breach was contained, the exposure of PII and PHI—particularly Social Security numbers and medical records—poses significant risks of identity theft, financial fraud, and medical fraud for victims. The company responded by securing the email account, enhancing security protocols, and offering 24 months of complimentary credit monitoring via Cyberscout. However, the breach’s severity stems from the highly sensitive nature of the leaked data, which could enable long-term exploitation by cybercriminals. Affected individuals were advised to monitor financial accounts, review credit reports, and consider fraud alerts or credit freezes.