Van Eck Associates Corporation, the New York investment manager known as VanEck, has notified individuals of a data breach. The company says an unauthorized third party obtained files from its network in April 2026, and that names, Social Security numbers and financial account numbers were involved. Firms that hold financial data must protect it.
VanEck’s Data Breach Investigation
Van Eck Associates Corporation does business as VanEck, a global investment management firm headquartered in New York City. It offers funds and investment strategies to individuals and institutions, and like other financial firms it keeps records that can include identification and account details for clients, employees and business contacts.
The public account of the incident comes from a notice that the company’s outside counsel sent to the New Hampshire Attorney General on October 2, 2026, along with a sample of the letter mailed to affected people. According to the notice, VanEck was alerted to suspicious activity in its environment on April 15, 2026. It took containment steps, including isolating relevant systems, and began an investigation to understand the scope of the activity.
The investigation determined that an unauthorized third party accessed part of the company’s environment and obtained certain files from its network between April 14 and April 15, 2026. VanEck then reviewed those files to determine what information they held and whom it belonged to. It says it finished that review and the work of identifying address information on or about September 1, 2026, and it mailed written notice on or about October 2, 2026.
For New Hampshire, the company reported one resident affected. That figure covers only that state and should not be read as the total number of people involved. The notice does not say how many individuals were affected overall, how the third party got in, or who was responsible, and this page does not guess at those details.
The company states that it is not aware of any attempted identity theft or financial fraud connected to the incident. It also says it is evaluating additional technical security measures and reviewing its policies and procedures, and that it notified relevant regulators as necessary. VanEck is offering twelve months of credit monitoring and identity theft protection through TransUnion at no cost, and the letter explains that recipients must complete the enrollment themselves.
The gap between the April intrusion and the October notice reflects how these incidents often unfold. Containing a network incident can take days. Working out which individuals appear in the copied files takes far longer, because the files are often unstructured documents and spreadsheets that must be read and matched to people before any letters can be sent. People who receive a notice months after the event should still take it seriously.
A name combined with a Social Security number and a financial account number is a particularly sensitive set of details. The Social Security number is a long-lived identifier tied to credit, tax and benefits records, and a financial account number can be used in attempts to redirect funds or to make a phishing message look convincing. Because stolen files can be held for a long time before they are misused, monitoring credit reports and account activity for an extended period is a reasonable precaution.
It is also worth knowing how notice timing works. State breach laws generally require a company to notify affected people once it has confirmed that personal information was involved, and many companies treat the end of the file review as that confirmation point. In multi-state incidents the company usually files separate notices with each regulator, each listing the residents of that state, which is why a single regulator filing rarely shows the full scope. Anyone who lives outside New Hampshire and received a letter should not assume the one-resident figure describes their situation.
Financial services firms are frequent targets because they hold data with direct monetary value. These are general observations about the sector and are not confirmed facts about how this incident occurred.
If you received a letter from the company, keep it, note the enrollment deadline, and use only the contact details printed in it. Scammers sometimes follow publicized breach notices with fake calls and emails that claim to come from the company involved.
When Did This Breach Occur?
VanEck says it was alerted to suspicious activity on April 15, 2026, and that an unauthorized third party obtained files from its network between April 14 and April 15, 2026. It completed its file review on or about September 1, 2026, and began mailing written notice on or about October 2, 2026.
What Information Was Breached?
The company reports that the information involved includes name, Social Security number and financial account number. The sample letter filed with the regulator leaves the individual data fields as placeholder text, so your own letter will state which items apply to you.
What You Can Do
If you received a notice from VanEck, consider these steps:
- Read your letter carefully and keep it, including the enrollment instructions for the twelve months of credit monitoring being offered.
- Check your credit reports for free at annualcreditreport.com, and consider placing a fraud alert or credit freeze with Equifax, Experian and TransUnion.
- Contact your bank or financial institution if your account number was involved, and ask about added monitoring or a replacement account number.
- Review statements for activity you do not recognize, and report anything suspicious right away.
- Be cautious with unexpected calls, texts or emails that mention the company, and report identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against VanEck
If you were notified of the VanEck data breach, or you believe your Social Security number or financial account number was exposed, you may have legal options. Organizations are expected to protect the sensitive information they hold and to notify people when it is compromised, and a lawsuit can help hold an organization accountable when it falls short.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
