Daily Dark Web reported on October 23, 2025, that a threat actor claimed to have breached HSBC USA and offered an allegedly extensive customer database for sale. The report did not include an official statement from HSBC, a regulator filing, or evidence confirming that the database came from HSBC systems.
The threat actor claimed the data included names, addresses, Social Security numbers, dates of birth, phone numbers, email addresses, bank account numbers, transaction histories, account balances, stock and bond holdings, credit scores, risk tolerance, and investment experience. An affected-individual count, affected states, the date of any intrusion, and any company or regulator notification date were not disclosed. No official breach notification or class-action filing was identified in the consulted sources as of August 9, 2026.