F500 Banks & Financial · Commercial Banks · Structural / no discrete incident
M&T Bank
Headline
M&T has reported that a third-party vendor was breached around August 2025 - the pattern that now dominates this tracker.
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
M&T has reported that a third-party vendor was breached around August 2025 - the pattern that now dominates this tracker. M&T is a major Mid-Atlantic and Northeast regional bank whose substantial Maryland presence dates to its acquisitions of Allfirst (2003) and Provident Bankshares (2009); it later acquired Delaware-based Wilmington Trust (2011) and People's United (2022), which means DMV customers' records have moved between corporate entities more than once. Bank consolidation transfers customer data as an asset with each merger, and depositors are never asked.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Primary source. None recorded — Unverified - heuristic first draft.
Terms
Arbitration
Not independently confirmed this pass — standard binding arbitration + class action waiver expected.
Data sharing
CONFIRMED THIRD-PARTY VENDOR BREACH: One of M&T Bank's third-party service providers (reported as the law firm Gelinas & Ward LLP; not confirmed from a primary source) reportedly experienced a security incident around August 2025 — M&T's own systems were NOT affected, but the vendor breach exposed customer Social Security numbers and financial account details. Notification letters were reportedly sent April 17, 2026 (roughly 8 months after the underlying incident), and secondary reporting of the Massachusetts filing (made to the Office of Consumer Affairs and Business Regulation, not the AG) cites 462 affected Massachusetts residents; national scope not fully detailed in sources reviewed this pass.
Fees and billing
Not itemized this pass.
Contacts
Privacy contact. Not recorded.
Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
No sources are on file for this row yet.
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy mtb.com/privacy | Not fetched yet | NO (HTML only) |
| Terms of service mtb.com/terms-of-use | Not fetched yet | NO (HTML only) |
| Website No URL recorded | Not fetched yet | — |
| Primary source No URL recorded Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
No HQ state on file, so no state statute applies by headquarters.