Bank of America
Disclosed Feb 1, 20242 years ago57,028 affectedConfirmed
Infosys McCamish ransomware attack exposes Bank of America plan participants
Bank of America notified deferred compensation plan participants that service provider Infosys McCamish Systems was hit by a cyberattack around November 3, 2023, and told the bank on November 24 that plan data may have been compromised. Bank of America's own systems were not breached.
What is known
| People affected | 57,028 (as reported by the organization) |
|---|---|
| Disclosed | Feb 1, 2024 |
| Discovered | Oct 30, 2023 |
| Happened | Oct 29, 2023 |
| Attack | Vendor breach |
| Data exposed | Names, Addresses, Emails, Dates of birth, Social Security numbers, Financial |
| Sector | Finance · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| Notice letter filed with the Delaware DOJ: Bank of Americaattorneygeneral.delaware.gov · Official notice | Official notice |
| California AG breach notice: Infosys McCamish Systems (Bank of America plan participants)oag.ca.gov · Regulator | Regulator |
| Indiana Attorney General 2024 data breach report: Bank of Americain.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| Delaware DOJresidents of DE | Feb 1, 2024 | 898 |
| Indiana AGresidents of IN | Feb 1, 2024 | 479 |
| Researchtotal | Feb 2, 2024 |
Other breaches at Bank of America
| Breach | Affected | ||||
|---|---|---|---|---|---|
| Disclosed Mar 28, 2023Mar 28, 20233 years ago | Mar 28, 20233 years ago | Not stated | Finance | Confirmed | 495K |
| Disclosed May 18, 2020May 18, 20206 years ago | May 18, 20206 years ago | Not stated | Finance | Confirmed | Unknown |
| Disclosed Apr 9, 2018Apr 9, 20188 years ago | Apr 9, 20188 years ago | Not stated | Finance | Confirmed | Unknown |
| Disclosed May 20, 2015May 20, 201511 years ago | May 20, 201511 years ago | Not stated | Finance | Confirmed | Unknown |
| Disclosed Oct 8, 2014Oct 8, 201411 years ago | Oct 8, 201411 years ago | Not stated | Finance | Confirmed | Unknown |
| Lost backup tapes held data on 1.2 million federal charge card holdersFeb 25, 200521 years agoLost or stolen deviceUnverified | Feb 25, 200521 years ago | Lost or stolen device | Finance | Unverified | 1.2M |
History of this record
- 2026-09-25 · source: empty to https://www.in.gov/attorneygeneral/consumer-protection-division/id-theft-prevention/files/DB-Year-to-Date-Reportdec-2024.pdf · backfill source
- 2026-09-25 · attack: unknown to third-party · seed source
- 2026-09-25 · data_types: ["names"] to ["names","addresses","emails","dob","ssn","financial"] · seed source
- 2026-09-25 · summary: empty to Bank of America notified deferred compensation plan participants that service provider Infosys McCamish Systems was hit by a cyberattack around November 3, 2023, and told the bank on November 24 that plan data may have been compromised. Ban · seed source
- 2026-09-25 · title: empty to Infosys McCamish ransomware attack exposes Bank of America plan participants · seed source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (Delaware DOJ), confirmed by Delaware DOJ. Record counts are as reported. Not legal advice.