People whose brokerage accounts were opened with DriveWealth, LLC through a broker-dealer, investment adviser or other financial institution may be covered by at least 10 proposed class actions filed over DriveWealth’s September 2026 network breach. No class has been certified and there is nothing to file yet.
Allegations Only · No Settlement Yet
This article describes proposed class action lawsuits. Whatever the complaints claim is unproven. DriveWealth, LLC has not admitted wrongdoing and has not been found liable, there is no certified class, and there is nothing to claim at this time. This page is informational. It is not legal advice.
What the DriveWealth Lawsuits Are About
DriveWealth, LLC is a brokerage firm that other financial companies use to open securities accounts for their own customers. According to the breach notice it filed with the California Attorney General, people gave their personal information to DriveWealth through an introducing broker-dealer, a registered investment adviser or another financial institution so that DriveWealth could open a brokerage account for them.In that notice, DriveWealth says it found unauthorized access to its network that took place on September 4 and 5, 2026, and that each recipient’s full name and other personal data elements were exfiltrated, meaning copied out of its systems.
Within weeks, the litigation began. Between October 2 and October 14, 2026, at least 10 proposed class actions were filed against DriveWealth in the U.S. District Court for the Southern District of New York, the federal court in Manhattan. The first, No. 1:26-cv-08717, was filed on October 2. The complaints themselves are not yet publicly available, and the specific legal claims, proposed class definitions and relief they seek have not been published.
Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
What DriveWealth’s Notice Says Happened
DriveWealth’s letter to affected customers describes the incident briefly. The company says it recently discovered that someone had gained unauthorized access to its network between September 4 and September 5, 2026. It says it opened an investigation right away with outside cybersecurity professionals, confirmed that the intrusion was contained on September 5, and has not seen further unauthorized activity since.The notice does not say how the intruder got in, whether ransomware was involved, or who was responsible. It states that DriveWealth is not aware of any reports of identity fraud or misuse of the information as a direct result of the incident, and says the letters were sent out of an abundance of caution.
DriveWealth submitted a redacted sample of the letter to the California Attorney General, whose data breach listing gives September 4, 2026 as the date of the breach. The company has set up a response page at legal.drivewealth.com/cyber-response for questions about the incident.
Timeline
The incident dates come from DriveWealth’s notice; the filing dates come from federal court records.- September 4–5, 2026 — Unauthorized access to DriveWealth’s network takes place, according to the notice.
- September 5, 2026 — DriveWealth says its investigation confirmed the intrusion was contained.
- September 28, 2026 — DriveWealth’s investigation and document review conclude, identifying the people whose names and other data were taken.
- October 2, 2026 — The first three proposed class actions are filed in the Southern District of New York, Nos. 1:26-cv-08717, 1:26-cv-08723 and 1:26-cv-08736.
- October 5, 2026 — Two more suits follow, Nos. 1:26-cv-08766 and 1:26-cv-08792.
- October 6, 2026 — Three more are filed, Nos. 1:26-cv-08818, 1:26-cv-08820 and 1:26-cv-08830.
- October 7, 2026 — No. 1:26-cv-08868 is filed.
- October 14, 2026 — No. 1:26-cv-09049 is filed, bringing the count to at least 10.
What Information Was Involved
DriveWealth’s notice says the review that ended on September 28, 2026 found that each recipient’s full name was exfiltrated together with other data elements listed in the individual letter. In the public sample filed with California, that list is redacted, so the specific categories, and whether they differ from person to person, have not been made public.The notice does not say whether account numbers, Social Security numbers or other financial details were among the exfiltrated elements. Each recipient’s own letter is the only document that lists the elements involved for that person.
Who Is Affected
The people covered by the notice are customers who provided personal information to DriveWealth through a partner firm (an introducing broker-dealer, a registered investment adviser or another financial institution) to open a brokerage account. DriveWealth has not published a nationwide count of affected individuals.The only figure in the notice appears in its section for Rhode Island residents, which states that approximately 62,074 Rhode Island residents were impacted. California requires a business to send a sample notice to its Attorney General when a single breach involves more than 500 California residents, so the filing there indicates the incident crossed that threshold in California as well.
The Lawsuits in Manhattan Federal Court
All of the cases identified so far name DriveWealth, LLC as the defendant and were filed in the U.S. District Court for the Southern District of New York. They are proposed class actions, meaning each one asks to proceed on behalf of a larger group of people affected by the breach, not only the person who filed it. The first filed, No. 1:26-cv-08717, was docketed on October 2, 2026.The text of the complaints is not yet available on the public court-records services that mirror federal dockets, so the specific claims, the class each suit proposes and the relief requested cannot be confirmed from the filings. As of October 15, 2026, no order consolidating the cases had appeared.
When this many related suits are filed in one court over the same incident, they are commonly coordinated or consolidated before a single judge, and the court may appoint interim lawyers to lead the case for the proposed class. A consolidated complaint, if one is filed, generally replaces the individual complaints and can add or drop claims.
What DriveWealth’s Notice Offers
The notice offers 12 months of triple-bureau credit monitoring and credit report services from Experian, Equifax and TransUnion, along with fraud assistance, at no charge. The services are provided by Cyberscout, a TransUnion company. According to the letter, enrollment requires the unique code printed in it and must be completed within 90 days of the letter’s date, and the service may not be available to minors under 18.The letter also describes fraud alerts and security freezes at the three credit bureaus. These offers and descriptions come from DriveWealth and are separate from the lawsuits.
What Happens Next
In data breach litigation, the early months are usually spent organizing the cases: consolidating related suits, appointing lead counsel for the proposed class and filing a single operative complaint. The defendant then typically responds, often with a motion to dismiss, and the court rules on whether the claims can go forward. Class certification, if it happens, comes later.Many data breach class actions are resolved through a negotiated settlement, while others are dismissed, and neither outcome is a given in any particular case. If the DriveWealth cases settle, a court would have to approve the terms, and people covered by the settlement would receive notice explaining how to file a claim.
Is There Anything to Claim?
There is nothing to claim. The DriveWealth lawsuits are at the complaint stage, no class has been certified, and there is no settlement, claim form, settlement website or deadline. If a settlement is reached and approved, it will appear in our settlements listing.Questions
Is there a DriveWealth data breach settlement?
There is no settlement. At least 10 proposed class actions over the September 2026 DriveWealth breach have been filed in the U.S. District Court for the Southern District of New York, and all of them are at the earliest stage. No class has been certified, and there is no settlement fund, claim form or deadline.
What happened in the DriveWealth data breach?
According to the notice DriveWealth filed with the California Attorney General, the company discovered unauthorized access to its network that took place on September 4 and 5, 2026. DriveWealth says it brought in outside cybersecurity specialists, contained the intrusion on September 5, 2026, and has not seen further unauthorized activity since.
What information was taken in the DriveWealth breach?
DriveWealth’s notice says each recipient’s full name was exfiltrated from its network along with other data elements, which it identified after a document review that ended on September 28, 2026. The public sample of the notice redacts those other elements, so the full list of exposed information has not been published.
How many people were affected by the DriveWealth data breach?
DriveWealth has not published a nationwide total. The Rhode Island section of its notice states that approximately 62,074 Rhode Island residents were impacted, and the company submitted a sample notice to the California Attorney General, which California requires when a breach involves more than 500 of its residents.
Where were the DriveWealth lawsuits filed?
The suits were filed in the U.S. District Court for the Southern District of New York, the federal trial court in Manhattan. The first three, including No. 1:26-cv-08717, were filed on October 2, 2026, and more followed through at least October 14, 2026. No order combining the cases had appeared on the docket as of October 15, 2026.
What is DriveWealth offering people who received a breach notice?
The notice offers 12 months of triple-bureau credit monitoring and fraud assistance through Cyberscout, a TransUnion company, at no charge. It says enrollment must be completed within 90 days of the letter’s date using a code printed in the letter. This offer comes from DriveWealth and is separate from the lawsuits.
Sources
• DriveWealth data breach suit, No. 1:26-cv-08717 (S.D.N.Y.), first filed October 2, 2026 — CourtListener docket• California Attorney General — DriveWealth data security breach report
• DriveWealth Notice of Data Breach, redacted sample letter (PDF via the California Attorney General)
