Metropolitan Commercial Bank, a commercial bank headquartered in New York, New York, has been named in reports of a data breach at one of its third-party vendors. The reports say customer information may have been taken, and they list Social Security numbers as the type of data involved.
At the time this page was written, we could not find a notice from the bank itself, a state attorney general filing, or a news report that confirms the details. This page explains what is known and what is not.
Metropolitan Commercial Bank’s Data Breach Investigation
Metropolitan Commercial Bank is a bank based in New York, New York that offers business banking, cash management, and commercial lending. According to its public description, it serves corporate clients and fintech partners, so many of the people whose information it holds are business owners, employees of business clients, and customers of partner companies rather than only everyday retail account holders. That makes it harder for a person to know whether the bank holds their data at all.
The reports about this incident describe a data breach at a third-party vendor, not a break-in at the bank’s own network. Banks routinely rely on outside companies for services such as data processing, document handling, statement printing, and software, and those companies are given copies of customer records to do the work. When a vendor is breached, the bank is often the organization that has to notify people, even though the intrusion happened elsewhere. The vendor has not been named in the information we found, and we do not guess at its identity.
The same reports list Social Security numbers as the type of data involved. We could not locate an official source that confirms this. The bank has not posted a notice on its website that we could find, and a search of the California Attorney General’s public breach list did not show a filing under the bank’s name. We also found no mention in the other places where companies typically report incidents, such as other state attorney general sites or a securities filing. The reports we saw show an estimated number of people affected and a set of dates, but the numbers and dates are not backed by any official notice, and several other banks were described with the same dates. For that reason, this page does not repeat them.
What this means for readers is simple. If you have ever had a loan, deposit account, business account, or other relationship with Metropolitan Commercial Bank, or if your information could have passed through one of its partner companies, you may receive a letter. A letter is the most reliable way to learn whether your own information was involved, which items it covered, and what the company is doing about it. If you receive one, keep it, because it will usually give the dates, the cause, and any free credit monitoring that is being offered.
A breach at a vendor can be just as serious for the people affected as a breach at the bank. A Social Security number does not change, and once it is in the hands of criminals it can be used for years to open accounts, file false tax returns, or apply for credit. The risk is higher when the exposed information sits next to names, addresses, and dates of birth, which are commonly stored in the same records. The reports we saw do not say whether any of those items were included, and we do not assume they were.
When a vendor breach reaches a bank’s customers, notices often arrive in stages. The vendor first tells the bank what was taken, the bank then works out which of its customers are in the affected files, and letters are mailed only after that review. Some people are told months after the intrusion itself. A bank that serves business clients may also send notices to company contacts, authorized signers, or beneficial owners, so a person can be affected through a business relationship they did not think of as a personal one.
This page will be updated as better information becomes available. Until the bank or an official agency provides more detail, the scope of the incident, the number of people affected, and the exact timeline remain unconfirmed.
When Did This Breach Occur?
The date of the incident has not been confirmed by the bank or by an official filing. We could not find a reliable discovery date, a date the vendor was breached, or a date letters were mailed.
If you receive a notice, look for these dates in the letter itself. They are normally stated in the first few paragraphs, and they can matter if you later need to show when you learned about the exposure.
What Information Was Breached?
Reports about this incident list Social Security numbers as the type of data involved. The bank has not publicly confirmed that, and we found no official notice that lists the specific data elements.
Because a vendor was involved, the records may also include other details that banks collect, such as names, addresses, and account information. No source we found says that those items were exposed, so treat that as a possibility to check against your own letter, not as a fact. The notice you receive is the best guide to what applies to you.
What You Can Do
If you think you may be affected by this incident, or you receive a notice connected to Metropolitan Commercial Bank, consider these steps.
- Keep any letter you receive, along with the envelope and any reference or enrollment code, so you have a record of what you were told.
- If the notice offers free credit monitoring or identity protection, enroll before the deadline in the letter.
- Request your free credit reports from Equifax, Experian, and TransUnion at annualcreditreport.com and look for accounts or inquiries you do not recognize.
- Consider placing a free fraud alert or a security freeze with each of the three credit bureaus, keeping in mind that a freeze can delay new credit applications.
- Review your bank and card statements and be cautious with calls, texts, and emails that mention the bank or this incident, even if the sender seems to know personal details. Contact the bank through its official website or a number you already trust.
- Report suspected identity theft to the Federal Trade Commission at IdentityTheft.gov and to your state attorney general.
File a Data Breach Lawsuit Against Metropolitan Commercial Bank
People whose Social Security numbers and other personal information are exposed in a data breach may have legal options if the company or its vendor failed to use reasonable safeguards. Whether a claim exists depends on the facts, including what information was involved, how the incident happened, and how the bank and its vendor responded.
If you received a notice connected to Metropolitan Commercial Bank, or you believe your information was involved, you can speak with a lawyer about whether you may be able to join a class action lawsuit to seek compensation for the exposure of your information, the time you spent responding, and any losses you suffered.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
