Cetera Financial Group data breach: one employee email account, two rounds of letters

Date	Event
July 7 to August 21, 2025	Unauthorized access to one employee email account
March 25, 2026	First letters, including 110 to New Hampshire; report to Massachusetts (848 residents)
On or around June 30, 2026	Review of the affected data completed
September 2, 2026	Supplemental letters, including 2 more to New Hampshire
December 2, 2026	Enrollment deadline for monitoring in the September letters

What happened at Cetera Financial Group?

The September letter gives the account. Cetera became aware of suspicious activity in one employee email account and started an investigation. The investigation found the outsider had access to the mailbox for about six weeks. Cetera then reviewed the mailbox to find whose information was in it, and that review was completed on or around June 30, 2026. The letter does not say how the account was taken over, whether by phishing, a reused password or another route.

Why does the Massachusetts letter say so little?

Because Massachusetts law keeps the cause out of the letter. Cetera's March letter, as filed in Massachusetts, says it cannot describe the nature of the event because of the state's requirements, and points readers to its call line instead. The state's breach statute, chapter 93H, section 3, says the notice to a resident must not include the nature of the breach or the number of residents affected. Letters to residents of other states carry the "What Happened" paragraph. For how each state's law shapes the letter, see the state breach notification laws guide.

Why were there two rounds of letters?

Cetera's notice to New Hampshire says the second round reflects the ongoing nature of the investigation and response. The first letters went out in March. The September letter says the review was completed on or around June 30, and that Cetera then worked with a notice vendor to confirm contact details. The Massachusetts count of 848 was reported in March and covers the first round.

Record	People	Data it marks
Massachusetts OCABR, report 2026-457 (March 25, 2026)	848	SSNs, financial accounts, driver's licenses, card numbers
New Hampshire DOJ, first notice (March 25, 2026)	110	Not stated in the supplement
New Hampshire DOJ, supplemental notice (September 2, 2026)	2 more	Name and template fields

What information was exposed?

The letters say the email account held the reader's name and other data, but the filed copies leave the list as a template field. The Massachusetts record is the most specific source: it marks Social Security numbers, financial account numbers, driver's licenses and credit or debit card numbers.

What is Cetera offering?

Credit and identity monitoring through IDX at no cost. The March letter offers 24 months. The September letter gives 12 or 24 months as a template choice, with enrollment closing on December 2, 2026. Questions go to 1-855-830-5994, weekdays from 6 a.m. to 6 p.m. Pacific. Advisory clients can read the guide to why a CPA or advisory firm sent you a breach letter. The credit monitoring guide compares the offers.

What the documents leave open

• How the email account was accessed.
• The total number of people notified across both rounds and all states.
• Why letters went out in March, before the review was completed in June.