Janney Montgomery Scott, a brokerage and wealth management firm, has notified clients that a data security incident at one of its vendors involved their personal information. This page summarizes what the firm’s notice letter says.
Janney Montgomery Scott’s Data Breach Investigation
According to the notice letter Janney Montgomery Scott LLC filed with Massachusetts regulators, the incident took place at Alation, a data intelligence platform that Janney used as a vendor. The letter says Alation detected unauthorized access to its system on August 18, 2026, took steps to contain the intrusion and secure its systems, and began an investigation that same day. Massachusetts breach records list 2 Massachusetts residents, and Janney has not published a total for all states.
The letter says Alation engaged outside legal counsel, who in turn engaged a digital forensics and incident response firm to determine what happened and to review any potentially compromised data. Alation initiated containment measures, which confirmed the unauthorized access, and the letter says it also made changes such as tightening access controls. Parts of the filed copy of the letter are missing, so some details of Alation’s findings are not available.
On September 1, 2026, Alation notified Janney that certain kinds of personal information belonging to some Janney clients were impacted by the incident. Based on the information made available to it, Janney says it discovered on September 24, 2026 that the potentially impacted information included name, address, Social Security number or Tax Identification Number, and account number. The letter states that some of these data elements containing the recipient’s personal information were accessed.
Janney says it ended its contractual relationship with Alation in light of the incident. It also says it is not aware of any misuse of clients’ information at this time. As an added precaution, the firm is offering complimentary credit monitoring from Experian for 24 months, and instructions for enrolling appear at the bottom of the letter. The filed sample letter is undated, showing only October 2026, so the exact mailing date is not known.
The combination of data in this notice is serious. A Social Security or tax identification number together with a name, address and account number is the kind of information fraudsters use to impersonate a client, attempt to move money, open new accounts or file false tax returns. Unlike a password or a card number, a Social Security number cannot be easily replaced, so the risk can last for years and calls for steady monitoring rather than a one-time check.
The incident also shows how a vendor can become the weak point for a financial firm. Firms often share client data with software providers for analytics, record-keeping and reporting, and clients may not know which outside companies hold their information. When one of those providers is compromised, the effects reach the firm’s customers even though the firm’s own systems were not the entry point. Firms are generally expected to oversee their vendors and to limit what data those vendors can reach.
The letter urges clients to remain vigilant against cybersecurity threats and identity theft by regularly reviewing account statements and free credit reports, and to notify their financial advisor right away if they see anything suspicious. It points to attached information on reviewing credit reports, placing fraud alerts, freezing credit and contacting the Federal Trade Commission and state attorneys general. Janney lists a privacy officer, who can be reached by phone or at privacyofficer@janney.com, for questions.
Companies that hold sensitive financial information are expected to protect it with reasonable safeguards, and state laws require them to notify affected people. Attorneys are looking into whether Janney Montgomery Scott and its vendor took reasonable steps to protect the information involved and whether the notice met the standards that apply. The filed letter is a sample, so it does not show how many people received it or when each state’s notice was sent.
When Did This Breach Occur?
The letter says Alation detected unauthorized access to its system on August 18, 2026. Alation told Janney about the impact on its clients’ information on September 1, 2026, and Janney says it discovered on September 24, 2026 which types of information were potentially involved. The filed sample is dated only as October 2026. Parts of the letter are missing, so other dates in Alation’s investigation are not available.
What Information Was Breached?
Janney says the potentially impacted information included name, address, Social Security number or Tax Identification Number, and account number, and that some of these data elements containing the recipient’s information were accessed. The details can differ from person to person, so your own letter is the best guide to what applies to you.
What You Can Do
If you received a notice related to Janney Montgomery Scott or believe you may be affected, consider these steps:
- Read the notice carefully and keep it, along with any enrollment details for protection services it offers.
- Enroll in the 24 months of Experian credit monitoring using the instructions in your letter, and tell your financial advisor right away about anything suspicious in your accounts.
- Place a free fraud alert or a credit freeze with Equifax, Experian and TransUnion, and get your reports free at annualcreditreport.com.
- Review bank, card and insurance statements for anything you do not recognize.
- Be skeptical of unexpected calls, texts or emails that mention the incident, and report suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against Janney Montgomery Scott
If you received a notice from Janney Montgomery Scott, or you believe your Social Security number or account information was involved in the Alation incident, you may have legal options for holding the companies accountable for how they protected your data.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
