Redtail Technology, Inc., a widely used customer relationship management platform for financial advisors, has notified regulators that a social engineering attack against one of its employees led to unauthorized access to customer data, including Social Security numbers and account information. Technology vendors that manage sensitive financial data on behalf of other businesses have a responsibility to secure that information and to promptly notify anyone whose data may have been affected.
Redtail Technology’s Data Breach Investigation
On May 13, 2026, Redtail experienced a social engineering attack against an employee, through which an unauthorized third party gained temporary access to a limited subset of data and cloud platforms that Redtail’s team uses to manage and support its customer relationships. Once inside, the unauthorized actor began exfiltrating data from these systems. According to a notice filed with the New Hampshire Attorney General’s Office, Redtail’s security systems detected and contained the threat quickly, and the unauthorized user was removed from Redtail’s systems early in the day on May 14, 2026.
Redtail immediately worked with outside counsel and a leading third-party cybersecurity investigator to understand the nature and scope of the incident, including identifying any personal information that may have been implicated. That review determined that certain information related to Redtail’s business customers had potentially been accessed by the unauthorized actor, including the name and Social Security number of at least one individual connected to J.W. Cole Advisors, Inc., a Redtail business customer for which Redtail stores or maintains data on the customer’s behalf.
Because Redtail operates as a data processor for numerous financial advisory firms rather than interacting directly with the end clients whose data it stores, the notification process for this incident involved multiple parties: Redtail first notified the affected business customer, J.W. Cole Advisors, on June 8, 2026, roughly three and a half weeks after the intrusion, and then worked with that customer to facilitate appropriate notifications to individuals and regulators. This layered relationship between a technology vendor, its business customers, and the individuals ultimately affected is common in the financial services industry, where CRM and data management platforms often sit between advisors and their clients.
Software vendors serving the financial services sector are attractive targets for cybercriminals precisely because a successful attack on a single vendor’s systems can potentially expose data belonging to the customers of many different advisory firms simultaneously. Social engineering attacks, in particular, exploit human trust rather than technical vulnerabilities, making them difficult to fully prevent through technology alone; ongoing employee training and layered security controls are typically the primary defenses against this type of intrusion.
The exposure of a Social Security number together with an account number is considered a serious combination, since it can be sufficient for a criminal to attempt to access existing financial accounts directly or to open new accounts in the victim’s name. Individuals affected by this type of breach are generally encouraged to review their account statements and credit reports closely for an extended period following notification, since stolen data is sometimes held by criminals before being used.
Redtail has stated that it has implemented additional security measures on the affected systems, including strengthening access controls and providing additional alerts and training for employees, in an effort to prevent similar incidents from occurring in the future.
When Did This Breach Occur?
Redtail states that the social engineering attack occurred on May 13, 2026, and that the unauthorized actor was removed from its systems early on May 14, 2026. Redtail notified the affected business customer, J.W. Cole Advisors, on June 8, 2026, and mailed written notice to the affected New Hampshire resident on July 6, 2026.
What Information Was Breached?
According to Redtail’s notification, the information accessed included the affected individual’s name, Social Security number, and account number. Affected individuals were offered twenty-four months of complimentary credit monitoring and identity theft protection through Experian IdentityWorks.
What You Can Do
If you received a notification letter connected to this Redtail Technology incident, consider taking the following steps to protect yourself:
- Enroll in the complimentary Experian IdentityWorks credit monitoring offered in your notification letter.
- Request free copies of your credit reports from Equifax, Experian, and TransUnion at annualcreditreport.com.
- Consider placing a fraud alert or credit freeze on your credit files.
- Monitor your financial accounts closely for unauthorized activity.
- Report any suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against Redtail Technology
If you were affected by the Redtail Technology data breach, you may be entitled to compensation for the exposure of your personal information. Companies that fail to adequately protect sensitive customer data can be held accountable for the resulting harm.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
