Hightower wealth-management breach affects 131,483 people after two account compromises
Two compromised Hightower accounts allowed January file theft affecting 131,483 people. Reported data includes names, Social Security and driving-licence numbers. Affected families should check credit reports and consider credit freezes.
If you received a notice, review your credit reports and financial statements and consider freezing your credit with Equifax, Experian and TransUnion. The letter’s original 90-day monitoring enrolment window has passed; ask Hightower through your usual adviser whether assistance remains available.
What’s happening
Hightower Holding, the wealth-management group behind Hightower Advisors, Hightower Securities and Hightower Trust Company, disclosed unauthorised file downloads affecting 131,483 people. Two compromised accounts enabled downloads on 8–9 and 19–20 January. SecurityWeek and a law-firm announcement identify potentially exposed names, Social Security numbers and driving-licence numbers; the published company letter leaves individual data fields blank. The Maine filing lists 12 March as the discovery date, whereas Hightower’s letter describes discovering compromised accounts on 9 and 19 January; the sources do not explain this difference. Hightower said it secured its network, strengthened security and had no indication of related identity theft or fraud when notifying people. It offered 12 months of credit monitoring and fraud assistance, with enrolment required within 90 days of the letter. The consolidated federal litigation closed on 9 July following voluntary dismissal without prejudice. No later company confirmation of data recovery or subsequent misuse was found through 3 November. There is no consumer software patch.
- What
- Breach
- Affects
- Hightower Holding and its wealth-management subsidiaries
- Fixed in
- Nothing to patch
- Since
- 23 Mar 2026
- Closed
- 9 July 2026
Timeline
- Update
The court acknowledged the plaintiffs’ voluntary dismissal without prejudice, closing all consolidated cases under the master file. This was not a ruling on liability.
- Update
Related lawsuits were consolidated under the Adams case as In Re: Hightower Holding, LLC Data Breach Litigation.
- Update
Elliott Adams filed a federal lawsuit against Hightower Holding in the Northern District of Illinois, case 1:26-cv-03267.
- Made public
Hightower began written notifications to affected people. Its updated Maine filing reports 131,483 people affected, including 1,557 Maine residents.
- Update
Hightower discovered a second compromised account. Further files were downloaded without authorisation on 19–20 January.
- UpdateNothing to patch
Files were downloaded without authorisation on 8–9 January using a compromised account. Hightower says it discovered that account on 9 January.
Sources
- Notice of Data BreachHightower Holding, LLC · 23 Mar 2026
- Data Breach Notices: Hightower Holding, LLC (Updated)Maine Attorney General · 23 Mar 2026
- PRIVACY ALERT: Hightower Holding LLC Under Investigation for Data Breach of Over 131,000 RecordsSchubert Jonckheer & Kolbe LLP via PR Newswire · 25 Mar 2026
- Hightower Holding Data Breach Impacts 130,000SecurityWeek · 26 Mar 2026
- Adams v. Hightower Holding, LLC — federal court docketJustia · 9 July 2026