M&T Bank mtb.com M&T Bank data breach: what happened and what to do
M&T Bank reported to HHS in June 2020 that a social engineering attack on an employee exposed health information of 5,878 people. It included names, addresses, Social Security numbers, driver's license numbers and health insurance details.
View all 13,177 breaches- Breach date
- 29 Jun 2020
- Made public
- 29 Jun 2020
- Affected
- 5,878
- Data exposed
- Names, Physical addresses, Bank account numbers, Health insurance information, Medical information, Social security numbers, Driver's licenses, Treatment information
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
M&T Bank reported to the U.S. Department of Health and Human Services (HHS) that an employee fell for a social engineering attack, which compromised protected health information. The HHS breach portal lists 5,878 people and a June 2020 report date. M&T acted as a business associate, handling health data on behalf of another organization.
HHS's case description says the information included names, addresses, financial and health insurance information, diagnoses, medications prescribed, Social Security numbers, driver's license numbers and other treatment information.
Social engineering means an attacker tricked a person rather than breaking in technically. Here that gave access to data that supports identity theft (Social Security and license numbers) and medical identity theft (insurance and treatment details).
M&T notified HHS, affected individuals and the media. It added administrative and technical safeguards and retrained staff on fraud and identity theft prevention.
If you received a notice, a credit freeze and careful reading of your insurance statements are the most useful steps.
Nothing in the HHS entry says the data was published or sold, so treat the risk as exposure, not confirmed misuse. Still, Social Security numbers don't expire, so a freeze is worth keeping.
Sources checked: ocrportal.hhs.gov, consumer.ftc.gov, identitytheft.gov
Last verified against the official page:
What to do if you were in it
- 1
Freeze your credit
Place a free credit freeze at Equifax, Experian and TransUnion, as the FTC explains. It blocks most new accounts opened in your name and you can lift it when you need credit.
- 2
Check your statements and insurance paperwork
Read bank statements and the explanation of benefits your health insurer sends, and question anything you don't recognize. If someone misuses your details, report it at IdentityTheft.gov.
- 3
Ask about replacing your driver's license number
If your license number was exposed, contact your state motor vehicle agency about options. Your bank can advise on bank account details.
- 4
Expect scams that mention the breach
Treat unexpected emails, texts and calls about the incident as suspect. Don't click links in them; use the contact details on the organization's own website or letter.
- 5
Check your email and phone in other breaches
Run a free Serus scan to see whether your email or phone appears in this and other breaches. Serus monitors breach databases and the dark web and alerts you when your data shows up. It can't remove data from a breach.
Official filings
- U.S. Department of Health and Human Services , filed 29 Jun 2020 : 5,878 people
Timeline
-
The breach happened
-
The company made it public
-
Reported to U.S. Department of Health and Human Services
Frequently asked
How many people were affected?
HHS lists 5,878 people.
What was exposed?
Per HHS: names, addresses, financial and health insurance information, diagnoses, medications, Social Security numbers, driver's license numbers and other treatment information.
How did it happen?
An employee was the victim of a social engineering attack, according to HHS.
Should I freeze my credit?
If your Social Security number was in your notice, yes. The FTC says a freeze is free.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
