OCC letter on breach of its email systems

The OCC has publicly released a letter sent to its supervised institutions regarding unauthorized access to OCC email systems. The OCC provided public notice of the unauthorized access and its designation as a major information security incident on April 8, 2025.

The OCC said it will inform each regulated institution if it determines the unauthorized user accessed information specific to that institution for their awareness. The OCC also will provide all supervised institutions with email user domains that were included in the compromised information so they may determine what information or data they may have sent to OCC users during the timeframe of the unauthorized access.