Fidelity Investments

Summary

Fidelity Investments experienced a data breach caused by an internal access‑control flaw that allowed unauthorized viewing of customer documents, exposing Social Security numbers, financial account numbers, driver’s license images and, in some cases, medical information. Approximately seventy‑seven thousand individuals received formal notice, while the settlement class covers about one hundred fifty‑five thousand people. The breach resulted in a $2.5 million class‑action settlement and a separate $1.25 million state regulator fine, with the firm required to hire an independent cybersecurity consultant, certify remediated controls and notify previously uninformed Massachusetts residents.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On August 17 through August 19, 2024, an unauthorized third party gained access to Fidelity Investments' computer network and obtained images of documents containing personally identifiable information, including Social Security numbers, financial account numbers, driver's license images, and in some cases medical information, passports, and credit card numbers. Fidelity detected the suspicious activity and determined the intrusion was a targeted cybersecurity attack rather than a broad opportunistic scrape. The breach stemmed from a failure in internal access controls that allowed users to retrieve documents that were not theirs to view, a flaw described as lacking an ownership check before returning document images. Approximately 77,099 individuals received formal breach notification, while an additional roughly 86,000 individuals whose financial account and routing numbers were exposed were not notified at the time because they fell outside state-law notification triggers, bringing the total potentially affected population to about 155,000 people. The accessed documents also included information of beneficiaries, relatives, and some minors connected to customer accounts.

In response to the breach, Fidelity faced two separate legal actions stemming from the same incident. A federal class-action lawsuit resulted in a $2.5 million settlement that received final court approval on July 9, 2026, with a claims filing deadline of July 27, 2026; under this settlement eligible claimants could receive a flat $100 cash payment (plus an additional $50 for California residents), seek reimbursement of up to $5,000 for documented out-of-pocket losses tied to the breach, and receive two years of identity theft protection and credit monitoring services. Separately, the Massachusetts Secretary of the Commonwealth William Galvin ordered Fidelity Brokerage Services to pay a $1.25 million penalty for failing to enforce appropriate cybersecurity controls and for failing to notify a subset of affected Massachusetts residents, including beneficiaries, relatives, and minors, after learning of the breach. The regulatory settlement required Fidelity to hire an independent cybersecurity consultant, certify that its data-protection systems had been strengthened, and identify and notify any Massachusetts residents connected to the breach who had not previously been informed. Neither settlement included an admission of wrongdoing by Fidelity.

The Massachusetts regulator’s order specifically cited that Fidelity’s insufficient enforcement of its technical security policies allowed a bad actor, over the three-day period in August 2024, to access images of documents containing Social Security numbers, active credit card and financial account numbers, medical information, passports, driver's licenses, and other personally identifiable information by manipulating a ten‑digit Image ID displayed in the browser to view another customer’s documents. Fidelity stated that it notified appropriate regulators and impacted customers in accordance with applicable laws and that, in the nearly two years since the incident, it has no evidence that identity theft or fraud occurred as a result of the breach. The company submitted an Offer of Settlement to the regulator on April 22, 2026, and had previously agreed in mid‑March 2026 to pay the $2.5 million to settle the class‑action lawsuit, which a U.S. district judge in Massachusetts preliminarily approved the week before the final approval hearing. The settlement administrator for the class action can be contacted to confirm eligibility for individuals who never received a breach notification but may still be covered by the settlement.

Sources

Sources available to members: 6 sources.