DriveWealth security breach impacts more than 2.5 million in Texas

US-based fintech provider DriveWealth said a data security incident in September compromised the sensitive personal information of over 2.5 million Texas residents.

Headquartered in New York City, DriveWealth is a US-based B2B fintech platform that provides Brokerage-as-a-Service (BaaS) through APIs, allowing non-brokerage companies such as digital wallets, fintech apps, banks and consumer brands to embed stock and investing features into their platforms. It supports trading in U.S. equities, ETFs, mutual funds, fixed income and options. In the UK, DriveWealth plays a key role in the digital investment sector, despite competition from domestic tech infrastructure providers.

In a data security incident notice published on its website, DriveWealth said it detected a network breach between September 4 and 5 involving unauthorised entry into its internal network and access to personal information stored on some of its systems.

The fintech company immediately launched an investigation, with assistance from external cyber security experts, to determine the nature and scope of the incident. It also took steps to secure the affected network and notified relevant law enforcement authorities the incident.

The investigation found that sensitive personal data belonging to customers was exfiltrated during the incident, including the personal information mentioned by the company in notices sent to affected customers. DriveWealth confirmed that no passwords or financial payment information such as credit card or bank account details were accessed during the incident.

“No unauthorized brokerage account activity including trading, transfer, withdrawal, ACAT request, or balance or position alteration was identified. Production brokerage and trading systems and the client-facing platform were not impacted by this activity and continue to operate normally,” DriveWealth said.

The incident was recently reported to the Texas Attorney General, where the fintech company said it has identified as many as 2,556,688 affected by the incinet.

The company has advised all affected individuals to regularly monitor their credit reports, account and benefit statements and report any suspicious activity to law enforcement authorities, including the police and the state attorney general.

Last month, one of DriveWealth’s clients, Revolut, revealed that the personal data of its U.S. customers had been compromised in a data breach. DriveWealth provides the trading and brokerage infrastructure that powers Revolut’s U.S. stock investment services.

Other companies affected by the DriveWealth data breach included Stake’s Australian operations and Hatch, a New Zealand-based investment platform, whose customers were also potentially impacted.

Please take 30 seconds to register

Already have an account? Sign in

"AI-led spear phishing worries me the most" - Darktrace's Dave Palmer

"Crisis or no crisis; security needs to be the same"

"People need to understand that there isn't an invisible force-field that's protecting them"

"The community needs to recognise and understand crime"

"We've seen a marked increase in social engineering attacks"

"AI-led spear phishing worries me the most" - Darktrace's Dave Palmer

"Crisis or no crisis; security needs to be the same"

"People need to understand that there isn't an invisible force-field that's protecting them"

"The community needs to recognise and understand crime"

"We've seen a marked increase in social engineering attacks"

$12M Vanishes in Crypto Heist Targeting Cork Protocol’s Depeg Market

$600 million stolen & returned in biggest ever crypto heist

10-month cyber attack exposes personal data of South Korean diplomats

Closing the exposure window — unifying continuous threat exposure management

Trusting your AI agents

The blind spots in your stack - why fragmented data security fails

Winston House, 3rd Floor, Units 306-309, 2-4 Dollis park, London, N3 1HF