Quick answer
Names, Social Security numbers, and financial information were taken for many people. DriveWealth says no passwords or payment card or bank account details were compromised, and no unauthorized trades or withdrawals were found. If your notice offers free credit monitoring, enroll, and consider a credit freeze if your Social Security number was involved.
What happened
DriveWealth says it found unauthorized access to its network that took place between September 4 and September 5, 2026, and contained it on September 5. News reports citing DriveWealth's partners say the access came from a social-engineering campaign. The company says its brokerage, trading, and client-facing platforms were not affected.
Many people don't know they have a DriveWealth account. If you opened an investing account through an app, broker, or advisor that uses DriveWealth to hold accounts, your information may have been involved. Revolut, Stake, and Hatch have told their customers they were affected.
DriveWealth hasn't published a total. Its filing with the Texas Attorney General lists more than 2.5 million Texans, and its Rhode Island notice lists about 62,000 Rhode Island residents.
What information was exposed
- Name
- Social Security number
- Financial information, which partner apps describe as things like account numbers, balances, portfolio values, and income ranges
- For some people, contact and employment details
Exactly what was taken varies by person. Your notice letter lists your information.
What to do now
- Read your notice letter carefully. It lists what was taken. If your Social Security number was involved, it includes a code for 12 months of free three-bureau credit monitoring through Cyberscout, a TransUnion company. You have 90 days from the date of the letter to enroll.
- Consider a free credit freeze at Equifax, Experian, and TransUnion. It stops anyone from opening new credit in your name, and you can lift it any time.
- Turn on two-factor sign-in for your investing app, and check its statements and transaction history for anything you didn't do.
- Watch for scam calls, texts, and emails that mention this breach. Scammers often pose as DriveWealth, TransUnion, or your investing app or a "breach settlement" service. Don't share passwords, codes, or payment details, and contact DriveWealth, TransUnion, or your investing app using a number you look up yourself.
- Get your free credit reports at AnnualCreditReport.com and look for accounts you didn't open.
Ask DriveWealth to delete your data
Fewer copies of your information means less to steal next time. Be aware that DriveWealth is a brokerage, and federal securities rules require brokerages to keep account records for years. Financial information covered by the federal Gramm-Leach-Bliley Act (GLBA) is also generally exempt from state deletion rights. Information that isn't part of those records may still be deletable. If your account was opened through an app, DriveWealth's privacy policy says to contact that app first.
Your legal right to deletion
If you live in a state with a consumer privacy law, such as California, Colorado, Connecticut, Maryland, Minnesota, or Oregon, DriveWealth generally has to respond to your deletion request within the deadline your state sets. Brokerage records it must keep by law, and financial information covered by the GLBA, are generally exempt. See what your state's law requires.
Find every company that has your data
A breach is a good reminder of how many companies hold your information. DataTrail scans your inbox (read-only) to find them all, flags the ones with data breaches, and writes the deletion requests for you to send.
Become a testerSources: California Attorney General breach notice, DriveWealth's web notice, GovTech, and BrokerChooser. DataTrail isn't affiliated with DriveWealth. This page is general information, not legal advice.