Fidelity Investments breach exposed personal data of 77,099 customers

Fidelity Investments told state regulators in October 2024 that a third party had obtained personal information belonging to 77,099 of its customers. The brokerage filed breach notices with the attorneys general of Maine, New Hampshire and Massachusetts, with 337 Maine residents among those affected.

According to the filings, the unauthorized access took place between August 17 and August 19, 2024. The intruder used two customer accounts that had been created shortly beforehand to submit requests against an internal database of customer document images, then retrieved documents belonging to other clients. Fidelity did not publicly explain how the newly created accounts were able to reach other customers' records.

The information exposed in those document images included Social Security numbers and driver's license details. Fidelity said it detected the activity on August 19 and immediately took steps to terminate the access, and that the incident did not give the third party direct access to client accounts or funds.

The company engaged outside security specialists to investigate and offered affected clients two years of complimentary credit monitoring and identity restoration services through TransUnion. The 77,099 people involved represented a small fraction of the roughly 51 million individual investors Fidelity served at the time.