M&T Bank Data Breach Exposes Sensitive Customer Information via Third-Party Provider In August 2025, M&T Bank a major financial institution headquartered in Buffalo, New York, with over 960 branches across 12 states discovered a data breach stemming from a security incident at one of its third-party service providers. While the bank’s own systems remained unaffected, unauthorized access to files containing customer data occurred within the vendor’s environment. The breach, disclosed to the Massachusetts Attorney General on April 17, 2026, exposed sensitive personally identifiable information (PII) of M&T Bank customers, including names, Social Security numbers, driver’s licenses, credit/debit card numbers, and financial account details. In Massachusetts alone, 462 individuals were confirmed as impacted. Class action law firm Shamis & Gentile P.A. is currently investigating the incident, assessing potential claims for affected customers who may be eligible for compensation. The breach highlights ongoing risks associated with third-party vendor security in the financial sector.

M&T Bank Discloses Third-Party Data Breach Affecting Customer Information M&T Bank, a regional financial institution serving over 3.6 million customers across 12 states and Washington, D.C., recently revealed a data breach stemming from a security incident at third-party law firm Gelinas & Ward LLP. The breach, which occurred in August 2025, exposed sensitive customer data, including Social Security numbers, financial account details, credit/debit card numbers, and driver’s license numbers. The bank confirmed that the breach originated entirely within the law firm’s systems, with no compromise of M&T Bank’s internal infrastructure. Upon discovering the incident, M&T Bank launched a review in collaboration with Gelinas & Ward to assess the scope and determine the affected data. While 462 Massachusetts residents were initially identified as impacted prompting a report to the Massachusetts Office of Consumer Affairs and Business Regulation the total number of affected individuals nationwide remains undisclosed. Notification letters were sent to impacted customers on April 17, 2026. In response, M&T Bank is offering 24 months of complimentary credit monitoring through Equifax Complete Premier, including three-bureau monitoring, identity theft insurance, and fraud detection tools. Affected customers can enroll using a unique activation code provided in their notification letter, valid for 90 days. Gelinas & Ward is separately providing TransUnion-based credit monitoring and identity restoration services to those affected. For inquiries, M&T Bank has established a dedicated helpline (1-800-724-2440), while Gelinas & Ward can be contacted by mail at 106 Merriam Ave., Leominster, MA 01453.