Skip to content
Breach Index · running record

Fidelity Investments data breach history (2016-2026): the 2024 document breach, the fine, the settlement and vendor incidents

Fidelity Investments (FMR) is one of the largest US brokerages and retirement providers. This page records its security incidents since 2016: the August 2024 breach of its own systems, the regulator fine and class settlement that followed, and a 2023 vendor breach that hit its life insurance arm.

Short answer

Was Fidelity hacked?

Yes. Fidelity’s notice letter says that between 17 and 19 August 2024 a third party “accessed and obtained certain information without authorization using two customer accounts that they had recently established”. Fidelity detected it on 19 August and cut off access. It told Maine’s Attorney General that 77,099 people were affected (per TechCrunch); a Massachusetts filing listed Social Security numbers and driver’s licences. Fidelity says no customer accounts or funds were accessed.

In April 2026 the Massachusetts Securities Division fined Fidelity Brokerage Services $1.25 million. The consent order, as reported by InvestmentNews, says the intruder viewed other customers’ document images by changing a ten-digit “Image ID” in the browser. Separately, Fidelity agreed to pay $2.5 million to settle a class action, which got preliminary approval in March 2026; Fidelity denied wrongdoing.

Earlier, in late 2023, ransomware at the vendor Infosys McCamish Systems exposed data on 28,268 Fidelity Investments Life Insurance customers, per The Register. Fidelity says its own systems were not involved in that one.

Timeline at a glance

  1. 29 Oct-2 Nov 2023Infosys McCamish (vendor) breach exposes Fidelity Investments Life customer data. (FILI letter (CA AG))Confirmed
  2. 5 Mar 2024FILI tells Maine 28,268 people affected; LockBit had claimed the vendor attack. (The Register)Reported
  3. 17-19 Aug 2024Intruder uses two new customer accounts to pull other customers’ documents. (Fidelity letter (CA AG))Confirmed
  4. 9-10 Oct 2024Notices filed: 77,099 people; SSNs and driver’s licences. (TechCrunch)Confirmed
  5. 11 Mar 2026$2.5M class settlement wins preliminary approval; Fidelity denies wrongdoing. (Bloomberg Law)Reported
  6. 27 Apr 2026Massachusetts fines Fidelity Brokerage Services $1.25M over the “Image ID” flaw. (InvestmentNews)Confirmed

Last updated November 13, 2026. Every entry is dated and linked to its source; claims by attackers are labelled as claims, never stated as fact.

Fidelity Investments incident timeline, in detail

Confirmed = acknowledged by Fidelity Investments, a regulator filing or a court. Reported = credible reporting Fidelity Investments has not fully confirmed. Unverified claim = an attacker or leak-site claim.

27 Apr 2026ConfirmedRegulatory action (state securities regulator)

Massachusetts fines Fidelity $1.25 million over the 2024 breach

What happened. The Massachusetts Securities Division, under Secretary William Galvin, fined Fidelity Brokerage Services $1.25 million. Per InvestmentNews, the consent order says “Fidelity’s insufficient enforcement of its own cybersecurity protocols allowed a bad actor” to view other users’ documents by changing the ten-digit “Image ID” shown in the browser, over three days in August 2024.

Impact. Fine of $1.25 million, an independent cybersecurity consultant, and certification of improved controls, per the report. The order says the exposed images included Social Security numbers, credit card and account numbers and medical information, and reached beneficiaries and relatives, some of them minors.

Sources: InvestmentNews, 27 Apr 2026

11 Mar 2026ReportedLitigation

$2.5 million class settlement over the 2024 breach

What happened. Bloomberg Law reported that Fidelity Investments agreed to pay $2.5 million to settle a proposed class action alleging it failed to protect “the personal information of more than 155,000 people”. The federal court gave preliminary approval. Fidelity denied wrongdoing.

Impact. Class members could claim up to $5,000 in documented losses, two years of credit monitoring and a pro rata payment of about $100, per Bloomberg Law. We did not confirm final approval.

Sources: Bloomberg Law, 11 Mar 2026

17-19 Aug 2024 (notified 9 Oct 2024)ConfirmedOwn systems / broken access control

Intruder pulls customer documents through two new Fidelity accounts

What happened. Fidelity’s letter says a third party used “two customer accounts that they had recently established” to obtain information between 17 and 19 August 2024; Fidelity detected it on 19 August and terminated access. TechCrunch reported a New Hampshire filing describing fraudulent requests to an internal database of document images.

Impact. 77,099 people, per Fidelity’s Maine filing as reported by TechCrunch. Data included Social Security numbers and driver’s licences, per a Massachusetts filing. No customer accounts or funds were accessed, Fidelity said. 24 months of TransUnion monitoring offered.

Sources: Fidelity sample notice letter, 9 Oct 2024 · California AG breach entry · TechCrunch, 10 Oct 2024

29 Oct-2 Nov 2023 (notified Mar 2024)ConfirmedVendor breach (Infosys McCamish Systems)

Infosys McCamish ransomware exposes Fidelity Investments Life customers

What happened. Fidelity Investments Life Insurance Company (FILI) said its policy administrator Infosys McCamish Systems had an intruder in its systems from 29 October to 2 November 2023. The letter says the incident “did not impact or involve any of FILI’s networks or systems”. LockBit claimed the Infosys attack, per The Register.

Impact. 28,268 people, per FILI’s Maine notice as reported by The Register. Data likely acquired: name, Social Security number, state of residence, bank account and routing number (if used for premiums) and date of birth. 24 months of TransUnion monitoring offered.

Sources: FILI sample notice letter (California AG) · California AG breach entry (FILI) · The Register, 5 Mar 2024

Where the reports disagree

  • How many people: Fidelity’s Maine filing says 77,099 (TechCrunch); Bloomberg Law’s settlement report says “more than 155,000 people”. Search results attribute to USA Today a figure of about 86,000 further customers whose account and routing numbers were exposed (via search); we could not confirm the breakdown.
  • Infosys dates: FILI’s letter says 29 October to 2 November 2023; The Register wrote 20 October. We use the letter’s dates.

The pattern across the record

The 2024 breach was an access-control bug, not a break-in

Per the Massachusetts order, a legitimate login was enough: changing a document ID in the browser returned other people’s files. This is the classic insecure direct object reference flaw.

Vendor breaches reach Fidelity customers too

The 2023 Infosys McCamish attack hit Fidelity’s life insurance customers through a policy administrator. Fidelity’s systems were not involved, but the customers still got letters.

What it means for Fidelity Investments customers — and what to do

If you got a Fidelity letter about the 2024 breach, documents with your Social Security number or account numbers may have been copied. Your login was not used, per Fidelity, so the risk is identity fraud and targeted scams.

  1. 1.Freeze your credit and get an IRS IP PIN

    Both are free and block the most common uses of a stolen Social Security number.

    SSN exposure action plan
  2. 2.Watch the accounts named in your documents

    If card or bank numbers were in the documents, ask the issuer for new numbers and turn on transaction alerts.

  3. 3.Treat breach-themed calls as suspect

    Call Fidelity back on the number on its website. Fidelity will not ask you to move money to protect it.

    Decode a breach notice
  4. 4.Lock down your own Fidelity login

    Use a unique password and the strongest two-step option Fidelity offers.

    Phishing-resistant MFA planner

CISO takeaways

Hunt for ID-swap bugs before attackers do

The Fidelity breach was a document ID that could be changed in the browser. Test every object lookup for authorisation, not just authentication.

Open the API security hub
Rehearse a customer database breach

Detection, scoping, regulator filings and customer letters, against the clock.

Customer database breach lab
Plan for vendor breaches

Infosys McCamish hit many insurers and recordkeepers at once. Know your notification duties when a processor is breached.

Third-party breach checklist

Sources

Company statements and regulator filings first, then reputable reporting. Reviewed November 13, 2026.

  1. 1.Client information data breach costs Fidelity $1.25 million in fine from Galvin — InvestmentNews, 27 Apr 2026
  2. 2.Fidelity Investments agrees to pay $2.5 million over data breach — Bloomberg Law, 11 Mar 2026
  3. 3.Fidelity says data breach exposed personal data of 77,000 customers — TechCrunch, 10 Oct 2024
  4. 4.Fidelity Investments notice of data breach (sample letter) — California AG, 9 Oct 2024
  5. 5.Breach entry: Fidelity Investments — California AG, 9 Oct 2024
  6. 6.FILI notice of data breach (sample letter) — California AG, 1 Mar 2024
  7. 7.Breach entry: Fidelity Investments Life Insurance Company — California AG, 1 Mar 2024
  8. 8.Report: Infosys McCamish breach hits Fidelity Investments Life customers — The Register, 5 Mar 2024

Frequently asked questions

Was Fidelity hacked?

Yes. Between 17 and 19 August 2024 a third party used two newly opened customer accounts to obtain other customers’ documents from Fidelity’s systems. Fidelity said 77,099 people were affected and that no accounts or funds were accessed.

What data was exposed in the Fidelity data breach?

Per a Massachusetts filing reported by TechCrunch, Social Security numbers and driver’s licences. The Massachusetts consent order, as reported, adds credit card and account numbers and medical information found in document images.

Is there a Fidelity data breach settlement?

Yes. Fidelity agreed to pay $2.5 million to settle a class action over the 2024 breach, with preliminary approval reported in March 2026. Fidelity denied wrongdoing. Check the settlement administrator for claim deadlines and final approval.

Was Fidelity fined for the data breach?

Yes. In April 2026 the Massachusetts Securities Division fined Fidelity Brokerage Services $1.25 million and required an independent cybersecurity consultant.

Was Fidelity Investments Life Insurance part of a data breach?

Yes, through a vendor. Ransomware at Infosys McCamish Systems in late 2023 exposed data on 28,268 FILI customers, including Social Security numbers and bank details. FILI said its own systems were not involved.

More in the Breach Index

Same sourced, verification-tagged timeline, company by company — compare how peers have fared.

Coinbase data breachFinancial services

Bribed support agents, 69,461 customers, an 8-K.

TransUnion data breachFinancial services

4.4M people via a third-party support app (2025).

Apollo Global Management data breachFinancial services

Social engineering and cloud platforms.

Invesco data breachFinancial services

No confirmed breach; 2024 vendor ransomware in Japan

Or see the full Breach Index and how to read it.

Independent analysis for security-leadership education; not affiliated with or endorsed by Fidelity Investments. Facts are attributed to the dated sources above, and anything disputed or unconfirmed is labelled as such. See the full Breach Index.