Wealth By Design, a financial services firm, has sent a notice about a data security incident that may have involved personal information. This page summarizes what the notice and the Massachusetts breach report say so far.
Wealth By Design’s Data Breach Investigation
Wealth By Design is the marketing name of a financial services firm whose professionals offer securities and financial advice through Osaic Wealth, Inc. In its notice, the firm says it is not affiliated with Osaic other than for that purpose. It has told people that a data security incident may have involved some of their information, including their name, Social Security number and financial account numbers. A sample of the notice was filed with the Massachusetts Office of Consumer Affairs and Business Regulation and posted on the state’s website.
The Massachusetts breach report, which lists the filing as reported on October 21, 2026, classifies the firm as a financial services company and shows 3 Massachusetts residents affected. The report flags Social Security numbers and financial account information as breached. It does not flag medical records, driver’s license numbers or credit and debit card numbers. Because the firm’s name is shared by several unrelated businesses, readers should rely on the notice they received rather than on the name alone.
The letter is brief about the incident itself. It does not say what happened, how the firm found out, when any unauthorized access began or ended, or whether an outside attacker, a vendor, a lost device or an employee mistake was responsible. It says only that the incident may have involved some of the recipient’s information. The sample on file leaves the date of the letter and the enrollment deadline as blank merge fields, so neither can be reported here.
No total number of affected people has been published. The figure of 3 covers only Massachusetts residents, and a wealth management practice may serve clients across many states, so notices could have gone to people elsewhere. The firm has not said how many clients, former clients or other people were notified.
To respond, the firm is offering identity monitoring through Kroll at no cost. The letter describes single bureau credit monitoring that sends alerts for 24 months from the date a person enrolls, whenever the credit file changes. It also describes proactive fraud assistance, unlimited consultation with a Kroll fraud specialist, and identity theft restoration with a dedicated investigator who works to resolve problems on the person’s behalf. People can enroll online using the membership number in their own letter, and the notice lists a phone line for questions about the monitoring service.
The firm also says it has taken steps to enhance its existing security measures to help prevent something like this from happening again. It does not describe what those steps are. The notice gives a direct line to the firm’s director of operations for questions about the incident itself, and a separate line for questions about the Kroll services.
Financial advisory practices hold the kind of information that identity thieves value most. Client files often combine a Social Security number with account numbers, dates of birth, addresses, tax details and signed forms, and that mix can support fraudulent account openings, attempts to move or withdraw money, and convincing impersonation of a client in calls or emails to a brokerage or bank. A Social Security number does not change, so the risk can last for years, which is why monitoring and a credit freeze matter even when no misuse has been seen.
If you received a notice from Wealth By Design, keep the letter and the envelope. Consider contacting your brokerage and bank to ask whether extra verification can be added to your accounts, and watch for unexpected requests to change account details. Attorneys are looking into whether the firm took reasonable steps to protect client information and whether its notice met the standards that apply to financial services firms.
When Did This Breach Occur?
The notice does not say when the incident happened or when Wealth By Design discovered it. The firm reported the matter to Massachusetts on October 21, 2026, according to the state’s breach report. It has not published a timeline of when unauthorized access began, was detected or ended, so the timing of the underlying event should be treated as unknown for now.
What Information Was Breached?
The notice says the incident may have involved a person’s name, Social Security number and financial account numbers. The Massachusetts breach report likewise flags Social Security numbers and financial account information, and does not flag medical records, driver’s license numbers or credit and debit card numbers. Not every person will have had every type of data involved, so your own letter is the best guide to what applies to you.
What You Can Do
If you received a notice related to Wealth By Design or believe you may be affected, consider these steps:
- Read the notice carefully and keep it, along with any enrollment details for protection services it offers.
- Enroll in the 24 months of Kroll credit monitoring and identity restoration offered in the letter, using the membership number in your copy, and ask your brokerage or bank about added account verification.
- Place a free fraud alert or a credit freeze with Equifax, Experian and TransUnion, and get your reports free at annualcreditreport.com.
- Review bank, card and insurance statements for anything you do not recognize.
- Be skeptical of unexpected calls, texts or emails that mention the incident, and report suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against Wealth By Design
If you received a notice from Wealth By Design, or you believe your information was involved, you may have legal options for holding the firm accountable for how it protected your Social Security number, financial account numbers and other sensitive information.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
