Vendor breach notices: how Directed Trust and Tradier describe the vendor and their own role

What this guide covers

You asked how notice letters describe a breached vendor, who sends the notice, and what the letter says about the vendor's role. The working title also named Bangkok Bank's audit vendor. No document about that case was supplied, so this guide does not cover it. It reads two notices filed with the California Attorney General with a date of 2026-10-27: one from Directed Trust Company and one from Tradier Brokerage Inc. Every factual statement below is attributed to one of those two letters.

Who sends the notice

In both letters, the company that has the customer relationship is the sender, not the vendor.

Directed Trust's letter opens by saying who is writing. The letter states, "Directed Trust Company ('Directed Trust') is writing to notify you of an incident that may affect your personal information." The letter is signed by the company, and the return address is a Cyberscout address. The letter shows "Directed Trust Company c/o Cyberscout 555 Monster Rd SW Renton, WA 98057".

Tradier's letter does the same, and it also says where responsibility sits. It states that the incident involved information "for which Tradier Brokerage Inc. ('Tradier') holds ultimate responsibility". That wording keeps accountability with the company that holds the customer's account, even though the attack was on a supplier.

How each letter describes the vendor

The two letters describe the vendor differently.

Directed Trust calls the vendor "our" platform. It says it became aware of activity "involving our electronic signature platform, Dropbox Sign". The letter gives a date for that awareness. It states, "On or about July 7, 2026, we became aware of suspicious activity involving our electronic signature platform, Dropbox Sign." In this letter the vendor appears as a tool the company uses. The text says the company "secured the Dropbox Sign access", which describes the company's own account on the platform. The letter does not describe any attack on the vendor's own systems.

Tradier names a separate company and describes what it does. The letter says that on September 3, 2026, "Tradier became aware of an attack against Etna Software Corporation". It then defines Etna's function, calling it "a company that provides the order management system and pre- trade controls used by Tradier in running its business". Here the vendor is a named third party, and the attack is described as an attack on that third party.

What each letter says about the vendor's role in the exposure

Directed Trust ties the exposure to documents held in the vendor platform. The letter says "The investigation determined that an unauthorized actor gained access to files containing personal information." It then draws a boundary around the incident. It states, "This incident was solely limited to documents submitted to us through our Dropbox Sign account." It also says that "our client portal and other systems were not affected, and there was no unauthorized access to your account log-in".

Tradier also draws a boundary, but between its own systems and the vendor's. The letter states, "Tradier’s network remained secure. Some data required for account identification by Etna may have been subject to unauthorized access." The letter lists the information involved as "your full name, address, phone number, and other PII including possibly your Social Security number".

Both letters use hedged language about the data. Directed Trust says information "may have been affected" for the recipient, after a review "completed on October 12, 2026". Tradier's letter says the data was "or is reasonably believed to have been" accessed, in its section on what you can do.

What the sender says it is doing about the vendor relationship

Directed Trust's letter says nothing about reviewing the vendor. Its response, as written, is an investigation, a file review and credit monitoring. The letter says the company is offering monitoring "through Cyberscout, a TransUnion company at no cost to you". It sets a deadline. The letter says "you must enroll within 90 days from the date of this letter". It also says "To date, we have no evidence of any fraudulent use of any data as a result of this incident."

Tradier's letter does address the vendor relationship. It says the review of affected accounts is being done "In conjunction with Etna". It then says, "We are actively reviewing our third-party relationships. We are reviewing our data minimization program." The letter offers "up to two years of free credit monitoring/identity theft protection services".

What to check in the filed text

The Directed Trust filing includes visible template text. The text contains "USBFSTest 1 Draft Steps You Can Take To Help Protect Your Personal Information" and a monitoring offer worded "for test". The Tradier filing's attachment text, as supplied, is garbled and cannot be read, so this guide relies only on its readable cover letter.

The letter's state-specific section gives a count. Directed Trust states that "There are approximately 56 Rhode Island residents that may be impacted by this event."

Taken together, the two letters answer your question as follows:

• The company with the customer relationship sends the notice.
• The vendor is described either as a platform the sender uses (Dropbox Sign) or as a named supplier with a stated function (Etna).
• The letters place the data exposure in the vendor's environment, while stating that the sender's own network or portal was not affected.