TD Ameritrade's 2023 MOVEit Breach and the Class Actions That Followed

TD Ameritrade and its parent Charles Schwab told the Maryland Attorney General that an intrusion into TD Ameritrade's own instance of the MOVEit Transfer file-sharing application exposed client data between May 28 and May 30, 2023. Over the following four months, at least six proposed class actions naming TD Ameritrade as a defendant were filed in federal courts in Nebraska and Massachusetts, several of them tied to the nationwide multidistrict litigation over the MOVEit vulnerability.

What the notice to Maryland says

Counsel for TD Ameritrade and Schwab notified Maryland's Attorney General on August 8, 2023. The notice attributes the underlying flaw to a widely exploited vulnerability rather than anything specific to TD Ameritrade's own systems:

The company's own investigation narrowed the window of access: The data types identified were , and for a small minority of people, health-related or biometric information. The notice states no other TD Ameritrade or Schwab systems were affected and that the company has not confirmed any resulting identity theft or fraud.

How many people were affected

The notice to Maryland gives only that state's count, as of the date it was filed: No nationwide total appears in that filing. Separately, reporting on an earlier company statement put a company-wide scale on the incident: InvestmentNews reported Schwab's own estimate that , adding that . This page states both figures rather than reconciling them, since the Maryland notice and Schwab's company-wide estimate measure different things at different dates.

The class actions

Federal court dockets show at least six proposed class actions against TD Ameritrade over this incident, filed between August and December 2023: Schultz v. TD Ameritrade, Inc. (first filed in the District of Nebraska on August 23, 2023, then again in the District of Massachusetts on October 31, 2023), two complaints captioned Jeanfort v. TD Ameritrade, Inc. (District of Nebraska, August 25 and August 28, 2023), Grande v. TD Ameritrade, Inc. (District of Massachusetts, October 31, 2023), and a further Jeanfort filing in Massachusetts on December 6, 2023. A sixth, Pitlor v. TD Ameritrade, Inc., was filed in the District of Nebraska on September 11, 2023. The repeated Nebraska-then-Massachusetts filing pattern matches the home court of the nationwide MOVEit case: the Judicial Panel on Multidistrict Litigation opened In re: MOVEit Customer Data Security Breach Litigation, MDL No. 3083, in the District of Massachusetts to coordinate pretrial proceedings across companies hit by the same vulnerability.

One of the Jeanfort complaints, as reported by 401(k) Specialist, puts a specific number on the claimed exposure and describes the theory of the case: had personal information exposed, according to the complaint, which argues TD Ameritrade did not use reasonable security procedures for the information it held and did not adequately vet MOVEit's own security before adopting it. The same report says the complaint also takes issue with timing — that TD Ameritrade learned of the intrusion "on or around May 30" but did not begin notifying affected people until August 3. These are claims made in a complaint, not findings a court has made.

What isn't on the record

No settlement, dismissal, or ruling specific to TD Ameritrade's share of the MOVEit litigation turned up in the sources checked for this page. The Maryland notice does not give a nationwide total, and none of the complaints reviewed name an individual at TD Ameritrade as responsible for the incident. TD Ameritrade has no security-leadership record yet on CISO Tribune, the network's mothership site.

FAQ

What happened in the TD Ameritrade data breach? Between May 28 and May 30, 2023, unauthorized individuals accessed TD Ameritrade's own instance of MOVEit Transfer, a file-sharing application, and took data that included names, Social Security numbers and financial account information, as part of a wider campaign against MOVEit users worldwide.

How many people were affected by the TD Ameritrade data breach? TD Ameritrade's notice to Maryland regulators confirmed 1,144 Maryland residents as of August 8, 2023, with more to be identified; Charles Schwab separately estimated that up to 55,000 clients company-wide, about 0.5% of Ameritrade's client base, may have been affected.

Is TD Ameritrade's breach related to the Progress Software MOVEit hack? Yes. TD Ameritrade's notice attributes the intrusion to the same zero-day vulnerability in Progress Software's MOVEit Transfer product that a cybercrime group exploited against hundreds of organizations in 2023.

Did customers file claims over the TD Ameritrade breach? At least six proposed class actions naming TD Ameritrade were filed in federal court in Nebraska and Massachusetts between August and December 2023, including complaints alleging inadequate security and delayed notification; no settlement or ruling specific to TD Ameritrade was found on the record as of this page's publication.

For more companies with both a disclosed incident and related litigation, see the data-breach class-action litigation tracker and the breach outcomes cross-reference.