DriveWealth, a U.S. brokerage infrastructure provider, began notifying people that an unauthorized party accessed its network on September 4 and 5, 2026, and copied personal information, including full names and other data elements.
DriveWealth’s Data Breach Investigation
DriveWealth, LLC is a U.S. company that provides the brokerage plumbing behind many investing apps and financial platforms. People typically never sign up with DriveWealth directly. Instead, they hand their personal information to an introducing broker-dealer, a registered investment adviser, or another financial institution, which then uses DriveWealth to open a securities brokerage account on their behalf. That arrangement means a security incident at DriveWealth can reach customers of several different consumer-facing brands at once, many of whom may not recognize the company’s name when a notice arrives in the mail or inbox.
According to the notice DriveWealth filed with the California Attorney General, the company discovered unauthorized access to its network that took place between September 4, 2026 and September 5, 2026. It states that it immediately launched an investigation with outside cybersecurity professionals, confirmed it had contained the compromise on September 5, 2026, and has not observed further unauthorized activity since. A document review that concluded on September 28, 2026 is what allowed the company to determine whose information was taken and what kinds of data were involved. The notice says each recipient’s full name, together with certain additional data elements, was exfiltrated from the network, meaning the data was copied out and not merely viewed.
The filed copy of the letter is a redacted template, and the specific list of data elements that applies to each individual is not filled in. DriveWealth has not published a single universal list in that document. Public reporting on the incident, which quotes the company’s communications to customers, describes the information as historic personal data held from the time people contracted with DriveWealth in the past. That reporting says the data may include names, email addresses, phone numbers, postal addresses, and employment details, along with country of citizenship, age, gender, and a partial DriveWealth account number. The same reporting says passwords and payment details such as card or bank account numbers were not part of the incident. Some partner platforms in other countries have told their own customers that additional account-related details may have been involved, so the exact scope can differ depending on which platform a person used.
The company’s notice includes a state-specific disclosure stating that approximately 62,074 Rhode Island residents were impacted. DriveWealth has not published a nationwide total in the materials reviewed for this page, and affected counts in other states may be reported separately as additional regulatory filings appear. News coverage has also described the incident as the result of a social engineering campaign carried out by unknown third parties, and has linked it to customers of international investing apps that relied on DriveWealth for U.S. stock trading. That cause has been attributed to the company’s own customer communications as relayed by the press, and the California filing itself does not describe how the intruders got in.
DriveWealth states that it is not aware of any reports of identity fraud or improper use of the information as a direct result of the incident. It is offering complimentary triple-bureau credit monitoring and credit report services for 12 months through Cyberscout, a TransUnion company, along with fraud assistance. Recipients are told they must enroll within 90 days of the date on their letter. The company has also set up a dedicated toll-free response line and a web page for questions.
Brokerage-related data is attractive to criminals for reasons that go beyond a single stolen record. A name combined with contact details, age, citizenship, and employment information gives a fraudster most of what is needed to impersonate someone convincingly in a phone call or email, particularly one that claims to come from a broker or bank. Because the people affected have investment accounts, they are also more likely to receive realistic-looking messages about account problems, transfers, or urgent security steps. Stolen information of this kind is frequently reused months after an incident, so the risk does not end when the initial notification period does.
Under state breach-notification laws, companies that lose control of personal information must tell affected residents and, in many states, the attorney general. These filings are what make the scale and timeline of an incident visible to the public. The dates in this matter are worth keeping straight: the unauthorized access happened on September 4 and 5, 2026, the company says it contained it on September 5, and the review that identified the affected data was completed on September 28, 2026.
When Did This Breach Occur?
DriveWealth reports that the unauthorized access to its network occurred between September 4, 2026 and September 5, 2026. The company says it contained the compromise on September 5, 2026 and has not seen further unauthorized activity. Its review of the affected data was completed on September 28, 2026, after which notification letters began going out and the notice was filed with state regulators, including the California Attorney General. Media coverage in late September 2026 reported that customers of several investing apps that use DriveWealth for U.S. trading were also being notified.
What Information Was Breached?
The notice says each affected person’s full name was taken along with additional data elements that vary by individual; the filed sample letter does not spell those elements out. Press reports quoting DriveWealth’s communications say the information may include names, email addresses, phone numbers, postal addresses, employment details, country of citizenship, age, gender, and a partial DriveWealth account number, and that passwords and card or bank account numbers were not involved. Customers of certain partner platforms were told that portfolio values and cash balances may also have been exposed. Anyone who receives a letter should read it closely, since it identifies the details that apply to them.
What You Can Do
Start by enrolling in the free credit monitoring DriveWealth is offering, using the instructions and unique code in your letter, within 90 days of the letter date. Review brokerage, bank, and card statements and your credit reports for activity you do not recognize. Consider placing a free fraud alert or a security freeze with Equifax, Experian, and TransUnion. Be cautious about unexpected calls, texts, and emails that mention your investment accounts, and never share passcodes or move money because someone contacted you first. You can get a free credit report at annualcreditreport.com, and suspected identity theft can be reported to the FTC at identitytheft.gov.
File a Data Breach Lawsuit Against DriveWealth
When a financial services company fails to protect sensitive customer information, the people affected may have legal options. Lawsuits over data breaches often allege that the company did not use reasonable safeguards and did not act quickly enough once a problem surfaced. Whether you can take part in a claim depends on your own circumstances, including what information of yours was involved and where you live. An attorney can review your notice letter and explain what steps may be available to you.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
