{"id":"drivewealth-investment-customer-breach-sep-2026","category":"breach","status":"closed","title":"DriveWealth breach exposed investment customers’ details and balance snapshots","tldr":"DriveWealth’s September breach exposed data of some Stake, Hatch and Revolut investment customers, including former customers. Some US customers’ Social Security numbers were involved. Check your notice and verify unexpected investment calls directly.","summary":"Attackers accessed DriveWealth’s network on 4–5 September 2026 and stole customer information. The US broker serves investment platforms including Stake, Hatch and Revolut, and some retained records concerned former customers. Stake identified contact details, account numbers, tax status and snapshots of portfolio values, cash balances and buying power; individual holdings and tax identification numbers were excluded. Hatch identified similar financial snapshots plus income and net asset ranges. Revolut said affected EEA records predated December 2023. The Houston Chronicle later reported that DriveWealth’s Texas filing identified more than 2.5 million affected residents and included Social Security numbers and financial information. Exposure therefore differs between customers and platforms. DriveWealth’s current notices give no worldwide total. It says no unauthorised brokerage transactions were identified, passwords and payment details were not compromised, and outside specialists validated its finding of no persistent threat. It reports no known resulting identity fraud or misuse. Customers have been notified, but the stolen information remains a potential fraud risk.","action":"Check your platform’s incident notice, including if you previously closed the account, and review account activity through its official app or website. Verify unexpected investment messages directly with your provider; never share passwords or authentication codes or move money at a caller’s request. Enable two-factor authentication, and if your notice says your Social Security number was exposed, follow DriveWealth’s credit-monitoring and credit-freeze guidance.","product":"DriveWealth brokerage services used by Stake, Hatch, Revolut and other investment platforms","audience":"home","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["drivewealth","data-breach","investing","stake","hatch","revolut","identity-theft"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"advisory","title":"US Customer Notification","url":"https://legal.drivewealth.com/cyber-response-us","by":"DriveWealth","date":""},{"kind":"advisory","title":"Non-US Customer Notification","url":"https://legal.drivewealth.com/cyber-response-nonuscustomers","by":"DriveWealth","date":""},{"kind":"advisory","title":"DriveWealth Data Security Incident","url":"https://hellostake.com/au/blog/stake-updates/drivewealth-data-security-incident","by":"Stake","date":"2026-09-21"},{"kind":"advisory","title":"DriveWealth cybersecurity incident","url":"https://help.hatchinvest.nz/en/articles/16968497-drivewealth-cybersecurity-incident","by":"Hatch","date":"2026-09-27"},{"kind":"news","title":"DriveWealth breach exposes data of Revolut customers who traded US stocks","url":"https://thenextweb.com/news/drivewealth-breach-revolut-customers-us-stocks","by":"The Next Web","date":"2026-09-24"},{"kind":"news","title":"Hatch investors warned personal data may be exposed in US cyber breach","url":"https://www.1news.co.nz/2026/09/22/hatch-investors-warned-personal-data-may-be-exposed-in-us-cyber-breach/","by":"1News","date":"2026-09-22"},{"kind":"news","title":"DriveWealth data breach may have exposed personal information of 2.5 million Texans, AG report says","url":"https://www.houstonchronicle.com/news/houston-texas/trending/article/drivewealth-data-breach-texas-22464805.php/","by":"Houston Chronicle","date":"2026-10-06"}],"started":"2026-09-04","closed":"2026-10-06","created":"2026-11-03T20:45:12.886Z","updated":"2026-11-03T20:45:12.886Z","cve_notes":[],"timeline":[{"at":"2026-10-06","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"The Houston Chronicle reported that DriveWealth’s 2 October Texas regulatory filing identified more than 2.5 million affected Texans. Reported information included names, Social Security numbers and financial information.","url":"https://www.houstonchronicle.com/news/houston-texas/trending/article/drivewealth-data-breach-texas-22464805.php/","by":"Houston Chronicle","patch":null},{"at":"2026-09-27","added":"2026-11-03T20:32:12.437Z","kind":"vendor-revised","text":"Hatch’s FAQ said DriveWealth had strengthened security controls and identified no ongoing threat. Hatch said passwords, identity documents, tax identifiers and children’s personal details were not exposed.","url":"https://help.hatchinvest.nz/en/articles/16968497-drivewealth-cybersecurity-incident","by":"Hatch","patch":null},{"at":"2026-09-24","added":"2026-11-03T20:32:12.437Z","kind":"disclosed","text":"DriveWealth and Revolut notified affected Revolut customers, according to The Next Web. Revolut said affected European Economic Area records predated December 2023; its own systems were not compromised.","url":"https://thenextweb.com/news/drivewealth-breach-revolut-customers-us-stocks","by":"The Next Web","patch":null},{"at":"2026-09-22","added":"2026-11-03T20:32:12.437Z","kind":"disclosed","text":"1News reported Hatch’s customer warning. Potentially exposed information included contact details, income and net asset ranges, cash balances and portfolio values, including records of some closed accounts.","url":"https://www.1news.co.nz/2026/09/22/hatch-investors-warned-personal-data-may-be-exposed-in-us-cyber-breach/","by":"1News","patch":null},{"at":"2026-09-21","added":"2026-11-03T20:32:12.437Z","kind":"disclosed","text":"Stake announced that some customers’ contact details, tax status, account numbers and portfolio and cash-balance snapshots were affected. It began emailing individual details and said its own systems were unaffected.","url":"https://hellostake.com/au/blog/stake-updates/drivewealth-data-security-incident","by":"Stake","patch":null},{"at":"2026-09-05","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"DriveWealth later said it contained the compromise on 5 September and had observed no further unauthorised activity.","url":"https://www.houstonchronicle.com/news/houston-texas/trending/article/drivewealth-data-breach-texas-22464805.php/","by":"Houston Chronicle","patch":null},{"at":"2026-09-04","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"Unauthorised access to DriveWealth’s network began. DriveWealth subsequently confirmed that personal information was stolen during access on 4–5 September.","url":"https://legal.drivewealth.com/cyber-response-us","by":"DriveWealth","patch":"na"}],"url":"https://hard.fyi/live/drivewealth-investment-customer-breach-sep-2026/","json":"https://hard.fyi/api/live?id=drivewealth-investment-customer-breach-sep-2026"}