U.S. Bank data breach: credit card numbers exposed at a service provider of FIS, May 2026

Date	Event	Record
May 7, 2026	FIS tells U.S. Bank that its own service provider had a security incident	Cardmember letter
May 19, 2026	U.S. Bank confirms with FIS that the reader's account was affected	Cardmember letter
June 30, 2026	Date on the cardmember letter	Cardmember letter
July 3, 2026	Report to Massachusetts (2026-1081): 2,422 residents	Massachusetts report
January 31, 2027	Last day to sign up for the credit monitoring offered	Cardmember letter

What happened in the U.S. Bank data breach?

The breach was two steps away from the bank. U.S. Bank's letter says FIS, its service provider, notified it that FIS's own service provider had a security incident in which some data was accessed without authorization. The bank then checked with FIS and confirmed on May 19, 2026 that the reader's account was among those affected. The letter does not name FIS's provider, say what kind of incident it was, or say when the access took place.

The vendor breach guide and the guide to letters from a company you never dealt with explain how a bank customer's data ends up with a processor's subcontractor. This chain is one link longer than most: bank, then processor, then the processor's own provider.

What information was exposed?

Three items: name, address and credit card number. The letter does not mention Social Security numbers, card security codes or expiration dates, and Massachusetts marks only the card category for this report. Because the card number itself was exposed, the bank's main step is a new card.

What is U.S. Bank doing, and what should cardholders do?

It is reissuing the affected cards at no cost and offering one year of TransUnion's myTrueIdentity credit monitoring. Sign-up is open until January 31, 2027, using the activation code in the letter at mytrueidentity.com. Questions about the monitoring go to TransUnion's team at 1-844-787-4607; questions about the card go to the number on the back of the card.

Until the new card arrives, the useful check is the card statement: look for charges you did not make and report them to the bank. The letter also recommends a fraud alert on your credit file, whether or not you enroll. The payment card breach guide compares other card-number notices, and the bank, brokerage and mortgage guide covers what financial firms tell customers.

Is this the same as U.S. Bank's prepaid card letter?

No. U.S. Bank filed a second, separate letter in Massachusetts a month later, for prepaid cardholders. It says the reader's prepaid card is believed to have had unauthorized access, and that the information involved may include name, address, email address, account number and Social Security number. That notice offers two years of the same TransUnion monitoring and does not mention FIS. Massachusetts recorded it on July 31, 2026, with 30 residents and Social Security numbers marked.

Vermont also lists a U.S. Bank notice, on September 9, 2026, with 8 residents and Social Security numbers, financial account codes and card information marked. The Vermont table does not say which incident that notice covers.

Notice	Record	Residents	Data
Credit cards, through FIS's provider	Massachusetts 2026-1081, July 3	2,422	Name, address, card number
Prepaid cards	Massachusetts 2026-1259, July 31	30	Name, address, email, account number, SSN
Not stated	Vermont, September 9	8	SSN, financial account, card information

How many people were affected?

The letter gives no total. Massachusetts counts 2,422 of its residents for the card notice. No other state record fetched for this entry gives a count for it, so the national figure is unknown.

What the documents leave open

• The name of FIS's service provider, and what kind of incident it had.
• When the unauthorized access happened, and how long it lasted.
• How many U.S. Bank cardholders, and whether other banks served by FIS, were affected.