Almeida Law Group is investigating a data breach at DriveWealth. The breach occurred on September 4th, 2026. If you were affected, contact Almeida Law Group.
About DriveWealth
DriveWealth, LLC is a B2B fintech company and registered U.S. broker-dealer headquartered at 28 Liberty Street in New York, New York. Founded in 2012, the company provides a Brokerage-as-a-Service platform through APIs, enabling banks, fintechs, and financial institutions — including Revolut, Stake, and Hatch — to offer securities trading and fractional share investing to their end customers around the world. Because DriveWealth operates as back-end infrastructure for consumer-facing platforms, many affected individuals may not have known the company held their personal and financial profile data.
What Happened?
DriveWealth was listed in a California Attorney General sample breach notice. According to that filing and DriveWealth’s own notice to affected customers, unauthorized access to the company’s network occurred between September 4th, 2026 and September 5th, 2026. DriveWealth determined that the intrusion was contained on September 5th, 2026, and its investigation — conducted with outside cybersecurity professionals — concluded on September 28th, 2026 that personal data had been exfiltrated from the network.
The attack was attributed to a social engineering campaign by unknown third parties who exploited an unidentified third-party service provider. DriveWealth confirmed that its production brokerage and trading systems were not affected and that no unauthorized trading, transfers, or withdrawals occurred. The breach had downstream effects on customers of partner platforms in multiple countries: Revolut (United States, United Kingdom, Ireland, the EEA, and Australia), Stake (Australia), and Hatch (New Zealand). The specific data exposed varied by platform. For most affected users, full names, email addresses, phone numbers, postal addresses, employment information, country of citizenship, age, gender, and partial DriveWealth account numbers were involved. Hatch customers also had investor profile information — including income range and net asset range — along with cash balance and portfolio value exposed. Stake customers also had W-8/W-9 tax status, country of taxation, DriveWealth account numbers, and aggregate snapshots of portfolio value, cash, and buying power exposed. Passwords, payment card numbers, bank account details, and identity documents were confirmed not compromised. DriveWealth is offering 12 months of complimentary Triple Bureau Credit Monitoring through Cyberscout, a TransUnion company, to affected U.S. consumers.
No ransomware group has publicly claimed responsibility, and no specific threat actor has been attributed. The incident was reported to the data protection authority in Lithuania in connection with Revolut EEA customers. Revolut stated that its own systems were not compromised and that for UK, EEA, and Australia customers, only historical records from before December 2023 through June 2025 (depending on market) were involved, because Revolut had stopped sharing individual customer details with DriveWealth after those dates; DriveWealth retained the records due to regulatory obligations. In the United Kingdom, JoinTheClaim.com has opened registrations for consumers who want to stay informed about potential legal action, though no formal lawsuit has been filed. No prior DriveWealth data breaches were identified in research.
Key Facts at a Glance
- Company or Organization: DriveWealth, LLC
- Industry: Financial Services / FinTech (Brokerage-as-a-Service, Investment Technology)
- Location: New York, NY (28 Liberty Street)
- Incident type: Unauthorized network access via social engineering; personal data exfiltrated
- Date of breach: September 4th, 2026
- Date breach discovered: September 28th, 2026
- Date of consumer notification: September 30th, 2026
- Identity theft protection offered: 12 months of Triple Bureau Credit Monitoring and Credit Report services via Cyberscout (TransUnion)
- Prior breach: None identified
- Litigation status: JoinTheClaim.com (UK) has opened registrations for potential legal action; no U.S. class action filed as of October 1st, 2026
- Source: California Attorney General filing; The Register; OODAloop; BeyondMachines; Finance Magnates via TradingView; JoinTheClaim
What Should You Do?
If you received a notice from DriveWealth, enroll in the complimentary 12-month credit monitoring through Cyberscout as soon as possible, and note any enrollment deadline stated in your notice. Whether or not you enroll in that service, consider placing a fraud alert or security freeze on your credit files with Equifax, Experian, and TransUnion. Review your credit reports for unfamiliar accounts or activity at AnnualCreditReport.com. Monitor your brokerage and financial accounts closely for unauthorized transactions. Because email addresses, phone numbers, and partial account numbers were exposed, be especially alert to phishing emails and phone-based scams that may reference your account or appear to come from a legitimate financial institution. If you suspect your information has been misused, visit IdentityTheft.gov to report and get a recovery plan.
Your Legal Rights
If your personal information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
