Bank, brokerage and mortgage breach notices: what financial firms tell customers

What these two notices cover

The question asks about banks, brokerages and mortgage lenders. The two documents supplied for this guide are both customer letters from brokerage firms, DriveWealth, LLC and Tradier Brokerage, Inc., each filed with the California Attorney General. Neither is from a bank or a mortgage lender, so this guide cannot say what banks or mortgage lenders tell their customers. It describes only what these two brokerages wrote.

The Tradier filing also includes an attachment with general consumer guidance. The text of that attachment is unreadable in the copy supplied, so nothing from it is reported here. The DriveWealth letter has blanks where the customer-specific details were redacted, and the guide notes where that matters.

What data each letter says was exposed

DriveWealth's letter tells the customer that the firm's investigation and document review concluded on September 28, 2026. The letter says that the customer's full name and certain other data elements were taken from the network. The list of other data elements is a placeholder in the filed copy, so this guide cannot say what DriveWealth listed. The letter's wording is "exfiltrated", which is stronger than "may have been accessed".

Tradier's letter is more specific about the categories, but it hedges about whether each one applies to each customer. The letter says the extraction file information may have included a customer's full name, address, phone number and other personal information, including possibly a Social Security number or similar government-issued tax ID number. The words "may have" and "possibly" mean a reader of this letter cannot tell from the letter alone whether their own Social Security number was in the file.

The two letters differ in how they describe the exposure. DriveWealth says data left its network. Tradier says data "may have been" accessed, and it describes the file as information that "was, or is reasonably believed to have been" accessed or used.

Who each firm points to

DriveWealth's letter points to the firm itself. It states that the unauthorized access was to "our network" and that it occurred between September 4, 2026 and September 5, 2026. The letter does not name any outside vendor as the source of the incident.

DriveWealth does explain why the customer is in its records. The letter says the customer gave their personal information through an introducing broker dealer, a registered investment advisor or another financial institution so that DriveWealth could open a securities brokerage account. A customer who has never heard of DriveWealth may therefore still be a DriveWealth customer through another firm.

Tradier's letter points to a vendor. It says that on September 3, 2026, Tradier became aware of an attack against Etna Software Corporation, which the letter describes as the provider of the order management system and pre-trade controls Tradier uses. The letter adds that Tradier's own network remained secure and that some data Etna needed for account identification may have been subject to unauthorized access.

The same letter does not hand responsibility to the vendor. It states that the information involved is information for which Tradier holds ultimate responsibility. The letter therefore names a vendor as the place of the attack while saying the brokerage remains responsible to the customer.

What each firm offers customers

DriveWealth offers complimentary credit monitoring. The letter says it is providing access to triple bureau credit monitoring and credit report services at no charge. The letter says the service sends alerts for 12 months from the date of enrollment when changes occur to the customer's Experian, Equifax or TransUnion credit files. It also sets a deadline, saying the customer must enroll within 90 days from the date of the letter.

The letter names the provider of the fraud assistance as Cyberscout, which it describes as a TransUnion company. It also describes a security freeze that a customer can request from the credit bureaus at no charge.

For questions, DriveWealth says it set up a toll-free response line. The letter gives the hours as Monday through Friday, 8:00 am to 8:00 pm ET, and says holidays are excluded. The phone number, email address and enrollment code are blank in the filed copy.

Tradier's offer is in the body of its letter. It says the customer can use a code to receive up to two years of free credit monitoring and identity theft protection services. The code is blank in the filed copy. The two offers differ in length: Tradier's letter says up to two years, while DriveWealth's alerts run for 12 months from enrollment.

What each firm says it is doing

DriveWealth describes an investigation with outside help. The letter says the firm launched an investigation in consultation with outside cybersecurity professionals. It says the compromise was contained on September 5, 2026 and that no further unauthorized activity has been observed.

The DriveWealth letter also reports on misuse. It says the firm is not aware of any reports of identity fraud or improper use of the customer's information as a direct result of the incident.

Tradier describes a shared review. The letter says that together with Etna, Tradier is reviewing the accounts of individuals with potentially affected records. It also says the firm is reviewing its third-party relationships and its data minimization program. The Tradier letter gives no containment date and no statement about whether fraud has been reported.

How many people, and what is missing

Only one of the two letters states a count. DriveWealth's letter says approximately 62,074 Rhode Island residents were impacted. The letter gives no total across all states. Tradier's letter gives no count in the readable text.

Taken together, the two letters show a pattern of gaps a security leader may want to note when reading any similar notice. One letter lists its data elements only through a placeholder in the filed copy, and the other qualifies each element with "may" or "possibly". Only one letter names the vendor involved, and that letter still says the brokerage holds ultimate responsibility. The documents supplied do not show whether bank or mortgage lender letters follow the same pattern.