In September 2025, PNC Financial Services suffered a data breach exposing sensitive personally identifiable information (PII) of customers. The breach involved unauthorized disclosure of names, addresses, account numbers, Social Security numbers, emails, phone numbers, and account types to another client and potentially to a threat actor on the dark web. A dark web posting by 'Market Exchange' claimed to sell 740,000 stolen records, though PNC has not confirmed the total number of affected customers. The breach was disclosed to regulators, and impacted individuals were notified via mail. The incident poses risks of identity theft, financial fraud, and reputational harm, with PNC offering credit monitoring services to mitigate fallout. Legal firms are investigating potential compensation claims for affected parties.

PNC Financial Services, a Pittsburgh-based financial institution, denied a widely circulated claim of a data breach allegedly exposing sensitive customer data in September. The company confirmed the allegations were false, originating from cybercriminals who fabricated posts targeting multiple reputable firms since March. While PNC’s cybersecurity team swiftly dismissed the claims as bogus, opportunistic law firms amplified the misinformation by linking it to an unrelated minor mailing error reported in Massachusetts—an act PNC described as reckless and deceptive to solicit lawsuits. The incident highlights how fake breach claims can trigger reputational harm, legal threats, and unnecessary customer panic, even when no actual data compromise occurs. PNC has threatened legal action against parties perpetuating the false narrative if the issue remains unresolved. The case underscores the growing risk of disinformation campaigns in cybersecurity, where malicious actors exploit public trust to manipulate markets or extort companies.