Orange Bank & Trust Company Data Breach Lawsuit Investigation
Received a September 2026 breach notice from Orange Bank & Trust?
Dapeer Law, P.A. is investigating a potential class action against Orange Bank & Trust Company, a community bank and trust company, on behalf of customers whose Social Security numbers and financial account information may have been exposed in a data breach at Mercadien, a service provider that stored bank files in the Box.com file-transfer platform.
Who may qualify
You may be eligible to participate in a class action if any of the following applies:
- You received a data breach notification letter from Orange Bank & Trust dated September 2026.
- Your letter offered enrollment in complimentary Experian IdentityWorks credit monitoring (three-bureau).
- You had personal or financial information held by Orange Bank & Trust as a banking or trust customer, including information the bank shared with its accounting service provider.
- No proof of harm required to consult with counsel. You do not need to have already suffered identity theft to explore your legal options.
- Excluded: individuals who did not receive a breach notice and whose information was not involved in the incident.
Not sure if you qualify?
Send us your notice, we'll confirm your eligibility at no cost.
What happened
Orange Bank & Trust Company reported that unauthorized actors accessed files stored in the Box.com environment of Mercadien, P.C., CPAs, a professional services provider the bank used. According to the notice, the unauthorized activity occurred between September 17, 2025 and October 8, 2025. The incident did not involve Orange Bank & Trust's own systems, but customer information that had been transferred through Box.com was affected. The bank filed notice of the incident with the Massachusetts Attorney General on September 2, 2026.
The notice states that Orange Bank & Trust reviewed the data Mercadien provided and, on August 28, 2026, determined which files contained customer information. Letters went out to affected individuals on September 2, 2026, offering complimentary Experian IdentityWorks credit monitoring covering all three credit bureaus. For Massachusetts residents, the filing identifies Social Security numbers and financial account information among the data elements involved and lists 40 affected residents. Nearly eleven months passed between the end of the unauthorized activity and the mailing of notice letters, a delay we are evaluating.
Social Security numbers and financial account information are among the most sensitive categories of data in a breach. Once exposed, a Social Security number cannot be changed, and it can be used for new-account fraud, tax refund fraud, and synthetic identity schemes for years after the incident. Banks and their service providers are also subject to data security obligations under the Gramm-Leach-Bliley Act and state financial privacy laws, which is one of the issues we are looking at.
What to do if you received a letter
Keep your notice letter
Do not discard it. Your letter contains the enrollment code for the credit monitoring being offered and is important evidence if you decide to participate in a lawsuit.
Enroll in the free Experian IdentityWorks credit monitoring
Enroll in the Experian IdentityWorks monitoring offered in your letter before the stated deadline. The service covers all three credit bureaus. Accepting this benefit does not waive your right to pursue legal action.
Place a fraud alert or credit freeze
Contact Equifax, Experian, and TransUnion to place a fraud alert or freeze on your file. Request a free weekly credit report from AnnualCreditReport.com, and use the FTC's IdentityTheft.gov recovery guide. Because Social Security numbers and financial account information are reported to be involved, also consider placing a free credit freeze with all three bureaus and watching for new accounts or loan applications you did not open.
Speak with a data breach attorney
Consultations with Dapeer Law are free and confidential. We'll review your notice, explain your options, and advise whether you may be eligible to join a class action.
Submit your notice for a free review
Two minutes online. A licensed attorney reviews every submission.
Breach timeline
Compensation you may be entitled to
Out-of-pocket expenses
Credit freezes, identity restoration services, and other costs incurred responding to the breach.
Time spent monitoring
Hours spent reviewing accounts, disputing fraudulent charges, and dealing with identity theft issues.
Identity theft & fraud losses
Unreimbursed funds stolen from accounts, unauthorized credit lines, fraudulent bank or credit account activity, or tax refund fraud tied to the breach.
Statutory damages
Certain state data breach and consumer protection statutes provide for fixed damages regardless of actual loss.
Injunctive relief
Court orders requiring Orange Bank & Trust and its service providers to implement stronger data security practices for customer files going forward, including tighter controls over information shared with outside vendors.
Compensation categories depend on applicable state law, the types of data exposed, and documented losses. No recovery is guaranteed.
Common questions
I received a data breach letter from Orange Bank & Trust. What should I do? +
Keep the letter. It contains your enrollment code for the Experian IdentityWorks monitoring being offered and documents that you were affected. Enroll in the monitoring before the deadline in your letter, place a free fraud alert or credit freeze with Equifax, Experian, and TransUnion, and review your bank and credit statements for activity you do not recognize. Because Social Security numbers and financial account information are reported to be involved, you can also report suspected identity theft at IdentityTheft.gov. A data breach attorney can review your notice at no cost and explain your options.
Am I eligible to join a class action against Orange Bank & Trust? +
People who received a breach notice letter from Orange Bank & Trust are the most likely candidates. Eligibility can also depend on your state of residence, the categories of information involved in your particular letter, and whether you have experienced fraud or out-of-pocket losses since the incident. A free case review is the fastest way to find out where you stand.
How much money could I receive from a class action lawsuit? +
Data breach class action recoveries vary significantly. Settlements typically range from a few hundred dollars for basic out-of-pocket losses to several thousand dollars for documented identity theft, with class size, damages, and negotiation all affecting the final amount. No payout is guaranteed, and this investigation has not yet resulted in a settlement.
What personal information was exposed in the breach? +
The filing with the Massachusetts Attorney General identifies Social Security numbers and financial account information among the data elements involved for Massachusetts residents. The notice letter describes affected files as containing an individual's full name along with additional personal information, with the specific elements listed in each recipient's own letter. Check your letter for the categories that apply to you, and note that the data elements can differ from person to person.
Did Orange Bank & Trust offer free credit monitoring? +
Yes. The notice offers complimentary Experian IdentityWorks credit monitoring covering all three credit bureaus. The version of the notice filed with the Massachusetts Attorney General does not state the number of months, so check your letter for the term, the activation code, and the enrollment deadline. Enrolling does not waive your right to bring a claim.
How many people were affected by the Orange Bank & Trust breach? +
The Massachusetts Attorney General filing lists 40 affected Massachusetts residents. The total number of people affected across all states has not been publicly disclosed, and because the incident happened at a service provider that worked with more than one institution, the full scope may be larger. This page will be updated as more becomes known.
Is there a deadline to take legal action? +
Yes. Statutes of limitations for data breach claims vary by state and legal theory, typically ranging from one to six years. Waiting can permanently bar your claim. Contact us as soon as possible for a free evaluation.
How do I get a copy of the official breach notice? +
The notice was filed with the Massachusetts Attorney General and is available through that office's data breach reporting page, and directly through the download link in the Sources section of this page. If you cannot locate your copy, Dapeer Law can help you obtain one during a free consultation.
Sources & references
- Official breach notice filing · Massachusetts Attorney General, Orange Bank & Trust Company data breach notice (PDF)
- Credit bureau freezes · Equifax · Experian · TransUnion
- Free weekly credit reports · AnnualCreditReport.com
- Identity theft recovery guide · FTC IdentityTheft.gov
Don't let the deadline decide for you. Submit your claim today.
You only have a limited window to act. Our team will review your notice, explain your options, and tell you whether you may be eligible to recover compensation, at no cost to you.
