Charles Schwab bought TD Ameritrade in 2020, so this page covers both. It records what Schwab and TD Ameritrade told state regulators since 2016, what court filings add, and what clients should do.
Short answer
Yes, through TD Ameritrade, which Schwab owns. In 2023 criminals exploiting the MOVEit Transfer zero-day stole files from a TD Ameritrade MOVEit application between 28 and 30 May. Schwab’s counsel told Maryland’s Attorney General that “No other TD Ameritrade or Schwab systems or data were impacted”. Data included names, Social Security numbers, account information, dates of birth and government ID numbers. A class action put the total at about 61,160 people; Schwab had earlier estimated up to 0.5% of TD Ameritrade clients.
Separately, Schwab notified clients in 2022 that between 18 May and 16 December 2021 some chat and email messages sent through Schwab.com went to external email systems by mistake, possibly including Social Security, ID and passport numbers or usernames and passwords. That was an error, not an intrusion.
We found no breach of Schwab’s core brokerage systems from 2016 to 2026 in the sources we read, and no SEC or FINRA cybersecurity penalty. Before this window, in 2016, Schwab warned clients of logins with passwords stolen from other sites.
Last updated November 13, 2026. Every entry is dated and linked to its source; claims by attackers are labelled as claims, never stated as fact.
Confirmed = acknowledged by Charles Schwab, a regulator filing or a court. Reported = credible reporting Charles Schwab has not fully confirmed. Unverified claim = an attacker or leak-site claim.
What happened. A 2026 Massachusetts notice by Purus Wealth Management, an independent adviser, says names and Charles Schwab account numbers were involved in a breach of external software it used (via search; we could not open the letter). Schwab’s own systems were not named.
Impact. Not a Schwab breach. Number of people not known to us.
What happened. Per the 8 August 2023 letter to Maryland’s Attorney General, “unauthorized individuals accessed a TD Ameritrade application of the MOVEit Transfer software and stole data”. TD Ameritrade and Schwab learned of it on 30 May 2023, stopped using MOVEit and alerted law enforcement. Cl0p ran the wider MOVEit campaign, per InvestmentNews.
Impact. Names, Social Security numbers, financial account information, dates of birth, government ID numbers and other identifiers; for “a very small minority”, health or biometric information. 1,144 Maryland residents. The Jeanfort complaint (D. Neb., 28 Aug 2023) says about 61,160 people; Schwab earlier estimated up to 0.5% of TD Ameritrade clients, which InvestmentNews put at up to 55,000. Free credit monitoring was offered.
Sources: Letter to the Maryland AG, 8 Aug 2023 · California AG breach entry · InvestmentNews, 14 Jul 2023 · Jeanfort v. TD Ameritrade complaint
What happened. Schwab’s letter says it found on 16 December 2021 that “certain chat and email messages sent through Schwab.com were inadvertently sent to external email systems” between 18 May and 16 December 2021.
Impact. Possibly name plus Social Security or tax ID number, driver’s licence or state ID, passport number, or username and password. Schwab said it had no evidence of misuse or account access. Two years of IdentityForce monitoring offered.
Sources: Schwab sample notice letter (California AG) · California AG breach entry
Both confirmed events sat at the edges: a file-transfer server TD Ameritrade used “on a limited basis”, and chat and email routing. Data in transit between systems is where Schwab’s exposure has been.
Schwab warned clients in 2016 (just before this page’s window) that passwords stolen from other sites had been tried successfully on Schwab.com. Reused passwords remain the usual route into brokerage accounts.
If you were a TD Ameritrade client in 2023 and got a letter, your Social Security number and account details may be in criminals’ hands. Your Schwab account itself was not accessed, per Schwab.
Free, and it blocks new-credit fraud and fake tax returns using your SSN.
SSN exposure action planSchwab’s own 2016 warning was about reused passwords. Turn on two-step verification and security alerts in your Schwab account.
Phishing-resistant MFA plannerStolen account numbers make scams convincing. Hang up and call Schwab on the number on your statement.
MOVEit hit hundreds of firms at once. Practise scoping what sat on a third-party tool and who must be told.
Vendor breach labState AG letters, customer notices and SEC rules run on different clocks. TD Ameritrade notified about ten weeks after discovery.
Notification clock calculatorReused passwords remain the commonest way into brokerage accounts.
Credential stuffing labCompany statements and regulator filings first, then reputable reporting. Reviewed November 13, 2026.
Not its core systems, per the sources we read. In May 2023 criminals stole files from a MOVEit file-transfer application run by TD Ameritrade, which Schwab owns. Schwab said no other TD Ameritrade or Schwab systems were affected.
Names, Social Security numbers, financial account information, dates of birth, government ID numbers and other identifiers, and for a small minority health or biometric information, per the Maryland filing.
A class action complaint puts it at about 61,160 people. Schwab had estimated up to 0.5% of TD Ameritrade clients. Maryland alone had 1,144 residents notified.
A class action, Jeanfort v. TD Ameritrade, was filed in Nebraska federal court in August 2023. We found no announced settlement as of 13 November 2026.
Schwab reported that between May and December 2021 some chat and email messages sent through Schwab.com went to external email systems by mistake, possibly including SSNs, ID numbers or login details. It offered two years of monitoring.
Same sourced, verification-tagged timeline, company by company — compare how peers have fared.
Bribed support agents, 69,461 customers, an 8-K.
4.4M people via a third-party support app (2025).
Social engineering and cloud platforms.
No confirmed breach; 2024 vendor ransomware in Japan
Or see the full Breach Index and how to read it.
Independent analysis for security-leadership education; not affiliated with or endorsed by Charles Schwab. Facts are attributed to the dated sources above, and anything disputed or unconfirmed is labelled as such. See the full Breach Index.