Financial firm breach notices: what DriveWealth and Tradier tell customers

What this guide covers and what it does not

The working title for this guide named four firms: DriveWealth, Tradier, Citizens Bank and MLD Mortgage. Only two source documents were supplied, the DriveWealth notice and the Tradier notice. No Citizens Bank or MLD Mortgage notice was provided, so this guide says nothing about those two firms.

Both documents are letters to customers that were filed with the California Attorney General. This guide reports what the letters say and attributes each fact to the letter. It does not add findings from outside the documents.

Two limits apply to the copies we read. In the DriveWealth copy, the list of exposed data elements is redacted and appears only as a placeholder. In the Tradier copy, the attachment text after the main letter is unreadable, so this guide does not describe the attachment.

How access happened

The two notices describe very different routes. DriveWealth describes access to its own network. Tradier describes an attack on a vendor.

DriveWealth's notice says the unauthorized access to its network occurred in a two-day window.

The notice says the company contained the compromise on a specific date.

It also says the company had seen no further activity when the letter was written.

The notice gives no technical detail about how the intruder got in. The text we read describes only "unauthorized access to our network" and an investigation with outside cybersecurity professionals.

Tradier's notice starts from a different place. It says the company learned of an attack on a supplier.

The notice explains the supplier's role this way.

The notice then says what may have been reached.

The notice separately says Tradier's own network remained secure. The notice also hedges. It says the data "may have been" accessed and that the information "was, or is reasonably believed to have been" accessed, so it does not state that access is confirmed.

Which account and identity data was exposed

The two notices are specific about different things.

DriveWealth explains why it holds the customer's data at all. The letter says the customer reached DriveWealth through another firm.

That matters for a reader who does not recognize the DriveWealth name. The notice says the recipient may never have dealt with DriveWealth directly.

On the data itself, DriveWealth says it found that the data was taken, not just reachable. The notice also gives the date its review ended.

The notice names the customer's full name. The other data elements are blank in our copy. Later passages about security freezes list the personal details a customer may need to supply, such as a Social Security number and date of birth. Those passages describe what a customer provides to a credit bureau, not what was taken, so they should not be read as the exposed list.

Tradier lists its data types in the letter body.

The word "possibly" is in the notice. Tradier does not say every recipient's Social Security number was involved. It also calls the affected material an "extraction file," which suggests a file pulled from the vendor's systems. The notice does not describe how that file was built.

What customers are told to do

Both notices recommend watching accounts. DriveWealth says there is no known misuse so far.

It then asks customers to stay alert.

DriveWealth also lists self-protection steps. These include anti-virus software, regular password updates, complex and unique passwords, and Multi-Factor Authentication "where possible." It adds a description of phishing, in which a fake email asks the reader to click a link, open an attachment or enter a username and password on an unauthorized website.

DriveWealth offers a free service with a deadline.

The notice sets a deadline for signing up.

The alerts run for 12 months from enrollment, and the services are provided by Cyberscout, a TransUnion company. The notice says enrollment requires an internet connection and an email account, and that it may not be available to minors under 18.

The DriveWealth notice then covers credit file protections. On fraud alerts it says what a fraud alert does.

It recommends an initial one-year fraud alert at no charge and says one call to any of the three bureaus is enough, because the others are notified once one confirms. On freezes, the letter presents a stronger step as optional.

The notice also covers the following points:

• A freeze generally stops credit bureaus from releasing the credit report without the customer's express authorization.
• Each bureau sends a PIN or password that is needed to lift the freeze.
• Customers are entitled to one free credit report every 12 months from each bureau.
• Customers may file a police report or an FTC complaint if they find misuse.
• The letter closes with state-by-state sections for Iowa, Maryland, Massachusetts, New Mexico, New York, North Carolina, Oregon, Rhode Island and Washington, D.C.

Tradier's instructions are shorter. The letter asks for account review and prompt reporting.

It offers a monitoring code as well.

Tradier says it will keep customers informed.

The letter also lists the company's own follow-up steps.

The letter gives a hotline for questions.

Reading the two notices side by side

Taken together, the notices show a pattern in what a customer receives:

• Access. DriveWealth says its own network was reached and gives a start date, an end date and a containment date. Tradier points to a supplier and gives only the date it became aware of the attack.
• Data. DriveWealth says data was exfiltrated, though the data elements are redacted in our copy. Tradier lists names, address, phone and possibly a Social Security or tax ID number, and uses conditional language throughout.
• Customer action. Both ask customers to review account activity. DriveWealth gives a 12-month monitoring offer with a 90-day enrollment window, and Tradier offers up to two years of monitoring.

The notices also differ in how much they hand the customer to do. DriveWealth's letter includes credit bureau contact details, freeze instructions and state rules. Tradier's letter body points to an attachment for those steps, and that attachment is unreadable in our copy.

What the notices leave out

Neither notice, as supplied, says how many customers were affected overall. The DriveWealth text includes a count for Rhode Island residents only. Neither says who the attacker was. Neither says how the intruder got in. Neither says whether a ransom was demanded.

Readers comparing firms should treat these as gaps in the letters, not as findings. A notice that is silent on a point does not show the answer is no.

The Citizens Bank and MLD Mortgage notices should be read directly before any comparison is drawn with the two letters covered here.