teiss – News – PeoplesBank discloses data breach at identity-verification vendor IDScan.net
ao link
PeoplesBank discloses data breach at identity-verification vendor IDScan.net
PeoplesBank disclosed a data breach that exposed personal information belonging to customers whose identification documents were scanned at its banking centers, after a security incident at IDScan.net, a third-party vendor the bank uses for identity verification.
IDScan.net informed PeoplesBank on Sept. 8, 2026, that it had identified unauthorized access to certain systems used to provide identity verification services. The unauthorized access occurred between April 2026 and September 2026. Because the breach took place within IDScan.net’s systems rather than PeoplesBank’s own infrastructure, the exposure was limited to customer data that had been transmitted to and stored by the vendor as part of the identification verification process; customers whose documents were scanned at a PeoplesBank banking center before September 2026 may have had their information exposed during that window.
The bank said the exposed information included full names, addresses, driver’s license or state identification numbers and dates of birth. The breach has affected at least 23,731 people in Massachusetts, according to PeoplesBank’s notification in that state. A separate filing with the Vermont attorney general’s office confirmed that Vermont residents were also affected and listed government identification numbers and biometric information among the exposed data; the investigation into the breach has focused on PeoplesBank customers, including account holders and loan customers, as well as anyone who used fingerprint or facial recognition to access their accounts. PeoplesBank has not disclosed the total number of people affected nationwide, when it first discovered the intrusion, or how the attackers gained access to IDScan.net’s systems.
PeoplesBank sent written notification letters to affected customers directing them to available identity protection reredit reports for suspicious activity. IDScan.net is offering complimentary credit monitoring and identity protection services to affected individuals, who can enroll through a dedicated notification page or by calling a phone line staffed Monday through Friday from 8 a.m. to 8 p.m. Eastern time
Edelson Lechtzin LLP, a law firm, said it is investigating potential data privacy claims related to the breach.
Please take 30 seconds to register
Already have an account? Sign in
