OneDigital Investment Advisors data breach: client records copied from Salesforce through the Drift app

Date	Event
August 12 to 18, 2025	Client data in OneDigital's Salesforce instance accessed and copied through Drift
August 22, 2025	Salesforce notifies OneDigital of a possible security event involving Salesforce and Drift
April 8, 2026	Letters begin; reports to Massachusetts (1,826) and Vermont (35)
April 10, 2026	WealthManagement.com reports the Maine filing: up to 28,414 people, 73 in Maine

What happened at OneDigital?

OneDigital did not get breached on its own network. Its counsel told Vermont that on August 22, 2025, Salesforce, its customer relationship management provider, notified it of a possible security event affecting Salesforce and Drift. The notice describes Drift as an online chat agent tool managed by Salesloft, OneDigital's former CRM provider. The letter to Massachusetts clients says it plainly: the incident involved a third-party application and did not compromise OneDigital's own internal network or systems.

So the route ran through an integration. The Drift connection had access to the firm's Salesforce data, and whoever compromised Drift used that access to copy records. WealthManagement.com cites a status update on the Drift breach saying it did not stem from a weakness in the core Salesforce platform but from a compromise of the Drift connection.

Why did the letters take eight months?

The notice gives the review as the reason. After the forensic investigation, OneDigital carried out what it calls a thorough and time-intensive review of the possibly affected data to find what sensitive customer information was in it. From Salesforce's notice on August 22, 2025 to the first letters on April 8, 2026 is 229 days. The notice delay guide compares that gap with other notices.

What information was exposed?

Name, Social Security number and individual taxpayer identification number, varying by person. Massachusetts also marks financial account information for its residents, which the Vermont notice does not list.

Record	People	Data it marks
Massachusetts OCABR, report 2026-542	1,826	Social Security numbers, financial accounts
Vermont AG notice, April 8, 2026	35	Name, Social Security number, ITIN
Maine AG notice, as reported by WealthManagement.com	28,414 total, 73 in Maine	Names and Social Security numbers

What is OneDigital offering?

Credit and identity monitoring through Experian IdentityWorks. The Massachusetts letter offers twenty-four months. The Vermont notice describes twelve months. The firm says it is reviewing its policies, procedures and processes for storing sensitive information. With Social Security numbers and ITINs in the records, a credit freeze at the three bureaus is the stronger protection. The Vermont notice says the letters also include guidance on protecting against tax fraud. For other advisers' letters, see the guide to letters from CPA and advisory firms and the EP Wealth Advisors entry. The guide to letters from a company you never dealt with covers vendor breaches like this one.

What the documents leave open

• Who compromised the Drift application; the filings do not name an actor.
• The Maine filing itself could not be opened for this entry, so the 28,414 total is as WealthManagement.com reported it.
• Why the Massachusetts and Vermont monitoring terms differ.