DriveWealth breach exposed investment customers’ details and balance snapshots
DriveWealth’s September breach exposed data of some Stake, Hatch and Revolut investment customers, including former customers. Some US customers’ Social Security numbers were involved. Check your notice and verify unexpected investment calls directly.
Check your platform’s incident notice, including if you previously closed the account, and review account activity through its official app or website. Verify unexpected investment messages directly with your provider; never share passwords or authentication codes or move money at a caller’s request. Enable two-factor authentication, and if your notice says your Social Security number was exposed, follow DriveWealth’s credit-monitoring and credit-freeze guidance.
What’s happening
Attackers accessed DriveWealth’s network on 4–5 September 2026 and stole customer information. The US broker serves investment platforms including Stake, Hatch and Revolut, and some retained records concerned former customers. Stake identified contact details, account numbers, tax status and snapshots of portfolio values, cash balances and buying power; individual holdings and tax identification numbers were excluded. Hatch identified similar financial snapshots plus income and net asset ranges. Revolut said affected EEA records predated December 2023. The Houston Chronicle later reported that DriveWealth’s Texas filing identified more than 2.5 million affected residents and included Social Security numbers and financial information. Exposure therefore differs between customers and platforms. DriveWealth’s current notices give no worldwide total. It says no unauthorised brokerage transactions were identified, passwords and payment details were not compromised, and outside specialists validated its finding of no persistent threat. It reports no known resulting identity fraud or misuse. Customers have been notified, but the stolen information remains a potential fraud risk.
- What
- Breach
- Affects
- DriveWealth brokerage services used by Stake, Hatch, Revolut and other investment platforms
- Fixed in
- Nothing to patch
- Since
- 4 Sept 2026
- Closed
- 6 Oct 2026
Timeline
- Update
The Houston Chronicle reported that DriveWealth’s 2 October Texas regulatory filing identified more than 2.5 million affected Texans. Reported information included names, Social Security numbers and financial information.
- Vendor revised
Hatch’s FAQ said DriveWealth had strengthened security controls and identified no ongoing threat. Hatch said passwords, identity documents, tax identifiers and children’s personal details were not exposed.
- Made public
DriveWealth and Revolut notified affected Revolut customers, according to The Next Web. Revolut said affected European Economic Area records predated December 2023; its own systems were not compromised.
- Made public
1News reported Hatch’s customer warning. Potentially exposed information included contact details, income and net asset ranges, cash balances and portfolio values, including records of some closed accounts.
- Made public
Stake announced that some customers’ contact details, tax status, account numbers and portfolio and cash-balance snapshots were affected. It began emailing individual details and said its own systems were unaffected.
- Update
DriveWealth later said it contained the compromise on 5 September and had observed no further unauthorised activity.
- UpdateNothing to patch
Unauthorised access to DriveWealth’s network began. DriveWealth subsequently confirmed that personal information was stolen during access on 4–5 September.
Sources
- US Customer NotificationDriveWealth
- Non-US Customer NotificationDriveWealth
- DriveWealth Data Security IncidentStake · 21 Sept 2026
- DriveWealth cybersecurity incidentHatch · 27 Sept 2026
- DriveWealth breach exposes data of Revolut customers who traded US stocksThe Next Web · 24 Sept 2026
- Hatch investors warned personal data may be exposed in US cyber breach1News · 22 Sept 2026
- DriveWealth data breach may have exposed personal information of 2.5 million Texans, AG report saysHouston Chronicle · 6 Oct 2026