HackingFinancial ServicesFinanceData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDCriticalContained

DRIVEWEALTH, LLC

bd_389a513f4e27d103 · schema v1 · pii pii-v2

Severity

Critical

Discovered

Sep 4, 2026

Filed

Sep 29, 2026

To disclose

25 days

Affected

525,639state residents only

Linked

7 filings

Confidence

67%

Full breach record for DRIVEWEALTH, LLC →

DriveWealth, LLC reported unauthorized network access occurring between September 4 and 5, 2026. The breach resulted in the exfiltration of customer names and government identifiers (SSN, DOB). DriveWealth contained the incident on September 5, 2026, and engaged outside cybersecurity professionals. Approximately 62,074 Rhode Island residents were identified as affected. The company provided 12 months of complimentary credit monitoring and fraud assistance to impacted individuals.

J jump to incidentP pin to compareR raw source

South Carolina clock✓ SC CRA notice due25 days discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 25 days

Sep 4, 2026

Begins

Sep 4, 2026

Discovered

Sep 29, 2026

Filed

vs. sector median

5 wks faster

This filing is one of 7 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Iowa State AGbd_4073e70b3c0460912026-09-29Verified
Delaware State AGbd_e1476c56dcc944132026-09-29Verified
California State AGbd_b38a2f757806b77b2026-09-30 · +1dCandidate
Massachusetts State AGbd_cdc9f273200ddbc82026-10-01 · +2dVerified

Show 2 more filings ↓up to 14d gap

Texas State AGbd_28bb5fc180c0b90a2026-10-02 · +3dVerified
Washington State AGbd_05223f0c5d38f06d2026-10-13 · +14dVerified

Name: DRIVEWEALTH, LLC
norm: drivewealth
Domain: drivewealth.com

Name: DRIVEWEALTH, LLC
norm: drivewealth
Domain: drivewealth.com
Industry: Financial Servicesllm

Discovered: Sep 4, 2026
Breach occurred: Sep 4, 2026 – Sep 5, 2026
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 525,639state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1119 Automated Collection
Threat actor: External

During the incident: Launched an investigation in consultation with outside cybersecurity professionals
Contained the compromise on September 5, 2026
Provided you with access to Triple Bureau Credit Monitoring/Triple Bureau Credit Report services at no charge
Providing you with proactive fraud assistance
Changes made: Continually evaluate and modify our practices and internal controls to enhance the security and privacy of your information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 25 days(25 days from discovery to filing)
Compliance flags: SC CRA notice due
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

Iowa State AGSep 29 · first

Delaware State AGSep 29 · first

South Carolina State AGSep 29 · first · this page

California State AG+1d

Massachusetts State AG+2d

Texas State AG+3d

Washington State AG+14d

Pattern: first filing Sep 29 (IA), last Oct 13 (WA) — a 14-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20DriveWealth%2C%20LLC.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 29, 2026
Raw hash: b227bcd5148139da45c3325a588a286b0b6e9fb5b3499dc27b577d0132ee266e

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityDRIVEWEALTH, LLC

Victim entityDRIVEWEALTH, LLC

Incidentdiscovered Sep 4, 2026

Stated responseLaunched an investigation in consultation with outside cybersecurity professionals

ComplianceSC CRA notice due

Extraction provenanceno artifact recorded

Source provenanceconsumer.sc.gov