Kovack Financial, LLC, the Fort Lauderdale, Florida-based parent company of broker-dealer Kovack Securities, Inc. and registered investment adviser Kovack Advisors, Inc., has notified individuals that a security incident involving its computer network may have exposed some of their personal information. Financial services firms that maintain client records have a responsibility to safeguard that information, and when an unauthorized party gains access to a network holding sensitive personal data, the people whose information was stored there deserve clear answers about what happened.
Kovack Financial’s Data Breach Investigation
According to a notification letter filed with the California Attorney General’s Office, Kovack Financial became aware of suspicious activity on its computer network on or around August 28, 2025. The company states that it promptly took steps to secure its network and launched an investigation to determine the full nature and scope of the incident. That investigation determined that an unknown actor gained access to files within the network between August 8, 2025 and August 27, 2025.
Kovack Financial then reviewed the accessed files to determine what information they contained and to whom that information related, for purposes of providing notice to affected individuals. The company states that on July 16, 2026, it determined that files containing information related to the recipients of its notification letter had been accessed. Kovack Financial’s notice does not itemize which specific categories of personal information were involved in the incident, and the company states that, to date, it has seen no indication of identity theft or fraud connected to this event.
Financial services and investment advisory firms are frequent targets for this kind of network intrusion because they typically retain detailed client records, including account information and other sensitive personal identifiers, for extended periods as part of regulatory recordkeeping requirements. A single unauthorized access event at a firm like Kovack Financial can therefore expose records that span months or years of client relationships, rather than a single point-in-time transaction.
The nearly eleven-month gap between the reported network intrusion and the company’s notification to affected individuals is not unusual for incidents of this kind. Determining exactly which files were accessed, what those files contained, and which individuals are implicated typically requires a lengthy forensic review, particularly at a firm managing records for many clients across multiple affiliated entities. Most state notification laws require companies to notify affected individuals within a reasonable time after that determination is made, not from the date the unauthorized access itself began.
Even where a company has not identified evidence of misuse, individuals whose information was stored on a network affected by unauthorized access are encouraged to remain alert for signs of identity theft or fraud, including unfamiliar account activity, unexpected communications referencing financial accounts, or notices about credit applications the individual did not initiate.
When Did This Breach Occur?
Kovack Financial’s notification letter states that an unknown actor gained access to files within its network between August 8, 2025 and August 27, 2025, after the company first became aware of suspicious network activity on or around August 28, 2025. The company determined on July 16, 2026 that files containing information related to affected individuals had been accessed, and notification letters followed.
What Information Was Breached?
Kovack Financial’s notification letter confirms that files containing personal information related to affected individuals were accessed during the incident, but the letter does not publicly itemize the specific categories of data involved for each individual. The company has not disclosed, in its public notice, a universal list of the exact data elements exposed.
What You Can Do
Kovack Financial is offering affected individuals twelve months of complimentary credit monitoring and identity restoration services through Cyberscout, a TransUnion company. If you received a notification letter from Kovack Financial, consider taking the following steps:
- Enroll in the credit monitoring and identity restoration services referenced in your notification letter within the stated enrollment window.
- Request and review your free credit reports from Equifax, Experian, and TransUnion at annualcreditreport.com.
- Monitor your account statements and explanation-of-benefits notices closely over the next 12 to 24 months for unfamiliar activity.
- Consider placing a fraud alert or credit freeze with the major credit bureaus if you notice any suspicious activity.
- Report any suspected identity theft to the Federal Trade Commission and your local law enforcement agency.
File a Data Breach Lawsuit Against Kovack Financial
If you received a notice that your personal information may have been exposed in the Kovack Financial data breach, you may have legal options. Financial services companies that collect and retain sensitive client information are expected to maintain reasonable safeguards against unauthorized access, and a failure to do so can leave affected individuals facing a lasting risk of identity theft and fraud.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
