GCSS Advisors Data Breach

GCSS Advisors, a Pittsburgh, Pennsylvania-based financial advisory firm, has notified clients of a security event involving its email environment that may have exposed personal information. The firm is offering affected individuals complimentary credit and identity monitoring services. Financial advisory firms handle sensitive client data as a core part of their business and are expected to maintain safeguards adequate to protect that information from unauthorized access.

GCSS Advisors’s Data Breach Investigation

According to a notification letter filed with the Massachusetts Attorney General’s Office, GCSS Advisors experienced what it describes as “an email event” affecting some client information. The firm states it took steps to secure the affected email account, confirmed the security of its broader email environment, and conducted an investigation into the incident. GCSS Advisors also reports that it notified law enforcement and relevant regulatory authorities, and that it is reviewing and enhancing its internal policies and procedures to reduce the likelihood of a similar event recurring. The notification letter does not disclose additional detail about how the email account was compromised, citing limits under Massachusetts law on the level of detail that can be included in a breach notice.

Email-based security incidents, often the result of phishing or compromised login credentials, are a common entry point into financial services environments because a single compromised employee mailbox can expose years of client correspondence, account documents, and personal identifying information all at once. Firms in the wealth management and financial advisory sector are frequent targets precisely because the data that flows through client-facing email accounts, tax documents, account statements, wire instructions, is highly valuable for identity theft and financial fraud schemes. When a firm discloses that it cannot yet fully characterize the scope of exposed data, that is often because a full mailbox review takes considerably longer than confirming that unauthorized access occurred in the first place.

GCSS Advisors’ notification followed the standard pattern required by Massachusetts breach-notification law, which requires notice to affected residents and the state Attorney General’s office once an organization has confirmed a breach involving personal information. Clients of financial advisory firms should treat a notification letter from GCSS Advisors as confirmation that their own information was specifically involved, and should take the credit monitoring offer seriously given the sensitivity of information typically held by an advisory firm.

When Did This Breach Occur?

GCSS Advisors has not publicly disclosed the specific date or date range of the email security event in the portion of the notification letter available to the public.

What Information Was Breached?

The notification letter confirms that affected individuals’ names were involved, along with other personal data elements that the letter does not specify in the publicly available template. GCSS Advisors has not disclosed the complete list of data types involved in this incident.

What You Can Do

If you received a notification letter from GCSS Advisors regarding this incident, consider taking the following steps:

• Enroll in the complimentary 24 months of credit and identity monitoring services offered through IDX before the enrollment deadline.
• Review your credit reports and account statements for any signs of unauthorized activity.
• Consider placing a fraud alert or credit freeze with the major credit bureaus.
• Contact GCSS Advisors directly if you have questions about what specific information of yours may have been involved.
• Be cautious of unsolicited communications claiming to be from GCSS Advisors or IDX that ask you to provide personal information.

File a Data Breach Lawsuit Against GCSS Advisors

If you were notified that your personal information was exposed in the GCSS Advisors data breach, you may have legal options available to you. Financial advisory firms that collect and store sensitive client data are expected to maintain reasonable safeguards to protect that information from unauthorized access.

Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.