BNY Mellon Data Breach Exposes SSNs and Financial Information

BNY Mellon National Association, a nationally chartered bank and affiliate of The Bank of New York Mellon Corp., disclosed a data breach that may have affected participants in the company's employee Profit Sharing Plan.

The breach was reported to the Massachusetts Office of Consumer Affairs and Business Regulation, with 15 Massachusetts residents identified as affected.

BNY discovered the breach on March 10, 2026, and began sending notification letters to affected individuals on April 1, 2026.

What happened in the BNY Mellon data breach

The incident involved unauthorized access to a system used internally by BNY to manage its employee Profit Sharing Plan, or PSP. The PSP is an employee benefit program, and the affected system contained personal and financial details connected to plan participants' accounts.

BNY's investigation determined that no actions or edits were made by the threat actor while they had access to the system. However, the company said it could not confirm whether the unauthorized individual actually saw the personal information while they had access.

Since BNY could not rule out that the data was viewed, it is treating the incident as a potential exposure of personal information for all affected plan participants.

The types of personal information that could have been exposed include names, Social Security numbers, home addresses, bank account and routing numbers and Profit Sharing Plan payment information.

BNY Mellon's response to the breach

BNY is providing affected individuals and their families with 24 months of free identity theft protection services through IDX, an identity protection provider. The services include credit monitoring, CyberScan monitoring, personally identifiable information removal, a $1 million insurance reimbursement policy and fully managed identity theft recovery services.

Affected individuals can enroll in the IDX protection by calling 1-800-939-4170 or by visiting the IDX enrollment page. Each notification letter includes a unique enrollment code that is required to complete the sign-up process.

The deadline to enroll is Oct. 1, 2026. IDX representatives are available to assist with enrollment Monday through Friday from 9 a.m. to 9 p.m. Eastern Time.

For questions about the incident, BNY has set up a dedicated phone line at 1-800-418-0273.

Steps to take if your information was exposed

• Place a security freeze on credit files with Equifax (1-866-349-5191), Experian (1-888-397-3742) and TransUnion (1-800-680-7289) to help prevent anyone from opening new credit accounts using stolen personal information.
• Request free credit reports at AnnualCreditReport.com and review them carefully for unfamiliar accounts, hard inquiries or other suspicious activity.
• Monitor bank account and financial statements closely for unauthorized transactions or changes, since bank account and routing numbers were among the types of information potentially exposed in this breach.
• Place a fraud alert with one of the three major credit bureaus, which will automatically notify the other two and require creditors to take extra steps to verify identity before opening new accounts.
• Be cautious of phishing attempts that reference BNY Mellon or this data breach by name, as scammers sometimes use real breach notifications to trick people into sharing more personal information.
• Report any signs of identity theft to the Federal Trade Commission at 1-877-438-4338 or to local law enforcement, as an official report can help when disputing fraudulent accounts or transactions.