EP Wealth Advisors data breach: four hours on one employee's login, and client files copied

Date	Event
February 2, 2026	Automated monitoring flags activity; access found and ended after about four hours
March 4, 2026	277 New Hampshire residents identified
March 5, 2026	Notice to New Hampshire
March 6 to 10, 2026	Letters mailed by first-class mail
March 21, 2026	Report to Massachusetts (2026-439): 1,367 residents
June 30, 2026	Last day to enroll in the Experian monitoring in the letter

What happened at EP Wealth Advisors?

The firm told New Hampshire that it spotted suspicious activity on its network through automated monitoring and alerting, brought in outside cybersecurity experts, and shut the access down. The intruder came in with one employee's compromised credentials. The notice does not say how those credentials were obtained, or whether the account had multi-factor authentication. EP Wealth also reported the incident to law enforcement.

The access was short, but long enough to copy client records. The firm says the unauthorized party acquired copies of personal client data, including from a system it uses to manage its client relationships. California's record gives the same single date of breach, February 2, 2026.

What information was exposed in the EP Wealth breach?

The letter tells clients the unauthorized party obtained a copy of their name, address, email address, date of birth and tax ID, which is a Social Security number or an Employer Identification Number, and in many cases financial account numbers. It adds that other information a client shared with the firm about themselves or their family may also have been involved. So relatives named in a client's file may be exposed without ever having been EP Wealth clients.

Record	People	Data it marks
Massachusetts OCABR, report 2026-439	1,367	Social Security numbers, financial accounts, driver's licenses
New Hampshire DOJ notice, March 5, 2026	277	Name, address, email, date of birth, tax ID, financial account numbers
California AG record	not stated	Date of breach February 2, 2026

Was EP Wealth client data published?

The firm told New Hampshire it had no sign that the data had been publicly disclosed or misused. That was its position on March 5, 2026, with the investigation still open. No later notice was found in the state records checked for this entry.

What is EP Wealth offering, and what should clients do?

Two years of Experian IdentityWorks credit monitoring, with up to $1 million in identity theft insurance and identity restoration. The enrollment deadline was June 30, 2026, so a code from the letter no longer works. The letter asks clients to review their credit reports and account statements over the next 24 months and to tell EP Wealth or the account's institution about anything unusual. With account numbers and tax IDs in the copied files, the useful steps are a credit freeze at the three bureaus and close attention to any request to move money that arrives by email or phone. The guide to letters from CPA and advisory firms covers this kind of notice, and the Regulation S-P explainer sets out the SEC's notice rule for advisers.

What the documents leave open

• How the employee's credentials were compromised.
• The total number of clients notified across all states.
• What else was in the client relationship records beyond the listed fields.