Hightower Holding

Summary

Hightower Holding disclosed a cyberattack in which attackers accessed and exfiltrated files containing names, Social Security numbers and driver’s license numbers of over 130,000 individuals. The breach stemmed from compromised user credentials rather than a system vulnerability. After reviewing the stolen data with third‑party experts, the company found no evidence that the information has been used for identity theft or fraud. It notified the Maine Attorney General’s Office about the incident and is providing affected individuals with twelve months of free identity theft and credit monitoring services.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

In early January 2026, Hightower Holding experienced a cyberattack that allowed unauthorized actors to access its network. Between January 8 and January 9, 2026, the attackers exfiltrated certain files from the company's environment. Upon discovering the intrusion, Hightower Holding engaged third‑party specialists to review the stolen data. The review determined that the compromised files contained personal information such as names, Social Security numbers, and driver’s license numbers.

The company determined that the breach resulted from compromised user credentials rather than a weakness in its technical environment. Hightower Holding notified over 130,000 individuals of the incident, with a subsequent filing to the Maine Attorney General’s Office stating that 131,483 people were affected. In its notification letters, the company stated that there was no indication that the exposed information had been used to commit identity theft or fraud. As a precautionary measure, Hightower Holding is offering the affected individuals twelve months of free identity theft and credit monitoring services.

Hightower Holding operates as a holding company for subsidiaries including Hightower Advisors, Hightower Securities, and Hightower Trust Company, which provide financial management, retirement planning, wealth and investment advisory services. The organization has not disclosed any details about the threat actor responsible for the attack, and SecurityWeek has not observed any known extortion group claiming responsibility for the breach. The notification and remediation efforts were communicated to impacted individuals this week, coinciding with the article’s publication date of March 26, 2026.

Sources

Sources available to members: 1 source.