Millbury National Bank Data Breach

Millbury National Bank, a community bank headquartered in Millbury, Massachusetts, notified customers in August 2026 that their personal and account information had been inadvertently disclosed to an unauthorized party as the result of an email phishing scam. Financial institutions that hold sensitive account and loan information have a responsibility to protect that information from unauthorized access, including through employee training designed to prevent phishing-based disclosures.

Millbury National Bank’s Data Breach Investigation

According to a notification letter dated August 26, 2026, Millbury National Bank informed affected customers that an email phishing scam at the bank resulted in their personal information being “inadvertently provided to an unauthorized party.” The bank’s letter distinguishes between what it describes as public information, including the customer’s name and mortgage lien information, and private information, including loan balance, payment status, account number, and phone number.

Millbury National Bank stated that it placed an alert on affected accounts and took steps intended to prevent unauthorized activity following the incident. The bank also cautioned customers that it will never request private information or account data over the phone or by email, and advised anyone contacted by someone claiming to represent the bank to verify the caller’s identity independently by calling the bank’s publicly listed number.

Phishing scams targeting financial institution employees are one of the most common ways unauthorized parties gain access to customer account data, since a single successful phishing email can expose the records an employee is authorized to access. Because loan balance, payment status, and account numbers were reportedly involved here, affected customers may face a heightened risk of targeted follow-up phishing or attempts to impersonate the bank using details from their own accounts.

When Did This Breach Occur?

Millbury National Bank’s notification letter identifies the phishing incident as having occurred on August 26, 2026, the same date the letter itself was issued to affected customers.

What Information Was Breached?

Per Millbury National Bank’s notification letter, the information involved included customers’ names and mortgage lien information (described by the bank as public information), along with loan balance, payment status, account number, and phone number (described by the bank as personal private information).

What You Can Do

If you received a notice from Millbury National Bank, or believe your information may have been affected by this incident, consider the following steps:

• Be alert for phone calls or emails claiming to be from Millbury National Bank, and verify any such contact by calling the bank directly using its published phone number.
• Regularly review your bank and loan account statements for unfamiliar activity.
• Consider placing a security freeze or fraud alert with the major credit bureaus.
• Monitor for phishing attempts that reference your real account or loan details, since exposed account information can make scam attempts appear more convincing.
• Keep your notification letter as documentation that you may have been affected.

File a Data Breach Lawsuit Against Millbury National Bank

If your personal or account information was compromised as a result of this incident, you may have legal options available to pursue compensation for any resulting harm. Financial institutions entrusted with sensitive account and loan information are expected to maintain reasonable safeguards, including employee training to prevent phishing-related disclosures, and a failure to do so can be the basis for a class action lawsuit.

Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.