{"id":"assetmark-customer-files-stolen-may-2026","category":"breach","status":"closed","title":"AssetMark customer files stolen through employee credentials; 570,000 people reported affected","tldr":"An intruder downloaded AssetMark customer files on 15 May; filings reported 570,000 people affected. Names, Social Security numbers and account numbers were potentially exposed. Check your notice, monitor accounts and consider freezing US credit files.","summary":"An unauthorised user downloaded customer files from AssetMark, the wealth-management platform used by financial advisers, on 15 May 2026. Subsequent filings reported 570,000 affected people. AssetMark's Rhode Island statement identified potentially exposed names, Social Security numbers and account numbers; each person's notice specifies their affected information. AssetMark said it terminated the access, reset employee credentials, strengthened monitoring and added safeguards. Notifications began in June, and a July supplement documented an expanded Rhode Island notification population. The company offered affected people 24 months of free credit monitoring and identity protection. Breach Census records a lawsuit filed on 22 June. As of 3 November, the sources reviewed do not establish a court outcome, recovery or deletion of the stolen files, criminal charges, or subsequent misuse of the information. This is a data breach with no customer software patch.","action":"If you receive an AssetMark notice, check which details it lists and use its instructions to enrol in the offered monitoring before your stated deadline. Consider freezing your US credit files at Equifax, Experian and TransUnion, review financial statements and credit reports, and promptly report unfamiliar activity to the account provider.","product":"AssetMark wealth-management customer records","audience":"both","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["assetmark","data-breach","financial-services","identity-theft","customer-data"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"advisory","title":"AssetMark Notice of Data Breach — undated sample customer letter","url":"https://www.nebraska.gov/ago/data-breach/documents/5c2e7b66-1909-4ed9-8b3c-c603b1b92bfc.pdf","by":"AssetMark","date":""},{"kind":"advisory","title":"AssetMark Supplemental Notice of Data Security Event","url":"https://riag.ri.gov/media/8951/download","by":"AssetMark, through Keesal, Young & Logan","date":"2026-07-08"},{"kind":"news","title":"AssetMark Inc. data breach notices, Jun 11, 2026 to Jul 8, 2026","url":"https://www.acidpeak.com/notices/assetmark-inc-2026-06-11/","by":"AcidPeak","date":"2026-09-30"},{"kind":"news","title":"AssetMark, Inc. — breach and litigation record, data as of 19 September 2026","url":"https://breachcensus.com/org/assetmark-inc","by":"Breach Census","date":"2026-09-19"}],"started":"2026-05-15","closed":"2026-07-08","created":"2026-11-03T20:55:22.860Z","updated":"2026-11-03T20:55:22.860Z","cve_notes":[],"timeline":[{"at":"2026-07-08","added":"2026-11-03T20:51:54.186Z","kind":"other","text":"AssetMark's supplemental Rhode Island filing said notifications there began on 18 June, initially covering 850 residents. By 6 July, it had supplied its mailing provider with files for notices to 1,644 affected residents.","url":"https://riag.ri.gov/media/8951/download","by":"AssetMark, through Keesal, Young & Logan","patch":null},{"at":"2026-06-22","added":"2026-11-03T20:51:54.186Z","kind":"other","text":"Breach Census records the filing of Warburton v. Assetmark, Inc., case 3:26-cv-06154, in the Northern District of California.","url":"https://breachcensus.com/org/assetmark-inc","by":"Breach Census","patch":null},{"at":"2026-06-18","added":"2026-11-03T20:51:54.186Z","kind":"other","text":"The Texas filing reported 570,000 affected people overall, including 29,802 Texas residents, according to AcidPeak's filing record.","url":"https://www.acidpeak.com/notices/assetmark-inc-2026-06-11/","by":"AcidPeak","patch":null},{"at":"2026-06-11","added":"2026-11-03T20:51:54.186Z","kind":"disclosed","text":"The breach was publicly disclosed, with filings recorded in Washington and Vermont.","url":"https://breachcensus.com/org/assetmark-inc","by":"Breach Census","patch":null},{"at":"2026-05-18","added":"2026-11-03T20:51:54.186Z","kind":"other","text":"Around this date, AssetMark's file review established that affected individuals' personal information was present. The company said the incident was confined to AssetMark and did not involve their financial advisers.","url":"https://www.nebraska.gov/ago/data-breach/documents/5c2e7b66-1909-4ed9-8b3c-c603b1b92bfc.pdf","by":"AssetMark","patch":null},{"at":"2026-05-15","added":"2026-11-03T20:51:54.186Z","kind":"other","text":"AssetMark discovered that an unauthorised user had accessed and downloaded customer files that day. It linked suspicious activity to employee login credentials and said it immediately ended the access and reset employee credentials.","url":"https://www.nebraska.gov/ago/data-breach/documents/5c2e7b66-1909-4ed9-8b3c-c603b1b92bfc.pdf","by":"AssetMark","patch":"na"}],"url":"https://hard.fyi/live/assetmark-customer-files-stolen-may-2026/","json":"https://hard.fyi/api/live?id=assetmark-customer-files-stolen-may-2026"}