Hightower data breach: two compromised accounts, files downloaded in January 2026

What happened at Hightower?

Two separate account compromises, eleven days apart. Hightower learned on January 9, 2026 that a user account had been compromised and used to get into its environment. It secured its network and began an investigation with outside cybersecurity and forensic specialists. That investigation found that files had been downloaded without authorization on January 8 and 9, 2026.

While it was still investigating the first event, Hightower found a second compromised account on January 19, 2026. A second investigation found more files downloaded on January 19 and 20, 2026. The letter does not say how the two accounts were compromised, whether they belonged to employees or advisers, or whether the same actor was behind both.

Date	What happened	Source
January 8 to 9, 2026	Files downloaded through the first compromised account	Notice letter
January 9, 2026	Hightower learns of the first compromised account	Notice letter
January 19, 2026	Hightower learns of a second compromised account	Notice letter
January 19 to 20, 2026	More files downloaded	Notice letter
March 23, 2026	Letter date; notice sent, per Indiana	Notice letter, Indiana AG
March 24, 2026	Logged in Massachusetts	Massachusetts list
March 25, 2026	Published by Texas	Texas AG list

Hightower's own account of the cause is that the events came from the two compromised credentials and not from a weakness in its environment. It says it has since added measures that apply to credentialed users too. The letters went out about two months after the second event. The guide to how long organizations take to notify sets that against other letters in this log.

How many people were affected?

Indiana's record is the only one that gives a total: 131,483 people. Three states count their own residents:

Record	People counted
Indiana attorney general, total	131,483
Massachusetts residents	4,888
Indiana residents	1,204
Texas residents	563

Massachusetts lists Hightower Holding, LLC as a financial services company, with the report received on March 24, 2026. Texas published its report on March 25, 2026. The total places Hightower among the larger 2026 notices on Indiana's list; the ranking of 2026 breaches by people affected shows where it falls.

Washington's attorney general lists a notice from Hightower Holding, LLC and its Hightower Advisors, Hightower Securities and Hightower Trust Company units, reported on March 23, 2026, with 7,528 Washingtonians affected. Its record names names, Social Security numbers, driver's license or state ID numbers, financial and banking information and full dates of birth as the information compromised. The Washington ranking compares 2026's notices. The figure counts Washington residents only.

What information was in the downloaded files?

The copy filed in Massachusetts leaves the list blank. The sentence that should name each reader's data runs straight from "The review determined that" to the end of the paragraph. The state records fill the gap:

• Texas lists names, Social Security numbers, driver's license numbers and financial information (account, credit or debit card numbers).
• Massachusetts marks Social Security numbers, financial account numbers and driver's license numbers as breached, and medical records and card numbers as not breached.

Hightower says it has no sign that anyone's information has been used for identity theft or fraud. Not every reader had every item; each letter as mailed lists that person's own data.

What is Hightower offering?

Twelve months of single-bureau credit monitoring and fraud assistance at no cost, through Cyberscout, a TransUnion company. Enrolment was at bfs.cyberscout.com/activate with the code in the letter, within 90 days of the letter's date. For a letter dated March 23, 2026, that window closed on June 21, 2026. The guide to credit-monitoring offers compares this offer with others.

Was my information in the Hightower data breach?

A letter from Hightower Holding dated March 23, 2026, sent from "c/o Cyberscout" in Dearborn, Michigan, means the review found your information in the downloaded files. The sample filed in Massachusetts leaves the assistance number blank; the line is open 8:00 a.m. to 8:00 p.m. Eastern Time, Monday to Friday. The guide to bank, brokerage and mortgage breach notices compares what other financial firms have told clients.

What the notice leaves open

• How the two accounts were compromised, and whose accounts they were.
• Whether the two events were linked.
• Which data each person lost; the filed copy leaves the list blank.
• Where the other people live: only Indiana gives a total, and the letter gives no breakdown by state or by client group.