Skip to content
Breach Index · running record

Franklin Templeton data breach (2023): the InvestorCOM vendor hack and what it exposed

Franklin Templeton’s one public data incident in the last ten years happened at a vendor. A Canadian company that prints and delivers investor documents was hacked through a flaw in its file-transfer software. This page sets out what Franklin Templeton, the vendor and the state filing said.

Short answer

Was Franklin Templeton hacked?

We found no confirmed breach of Franklin Templeton’s own systems from 2016 to 2026 in the sources we read. Its one disclosed incident was at a vendor: InvestorCOM, which Franklin Templeton Canada used to deliver documents to investors, was hacked through the Fortra GoAnywhere file-transfer flaw (CVE-2023-0669) in early 2023.

Franklin Templeton Canada notified 89,470 people in May 2023, according to its Maine Attorney General filing as reported by JD Supra. The data was names, addresses and Franklin Templeton account numbers. Franklin Templeton said none of its systems were breached, that Social Security numbers and birthdates were not taken, and that investor holdings were not affected.

Timeline at a glance

  1. 30 Jan 2023Attackers get into InvestorCOM’s GoAnywhere file-transfer server. (BankInfoSecurity)Reported
  2. 4 Apr 2023InvestorCOM tells Franklin Templeton Canada its client data was involved. (Maine AG filing via JD Supra)Confirmed
  3. 1 May 2023InvestorCOM says only its SFTP system was hit and a small number of Canadian clients affected. (InvestorCOM)Confirmed
  4. 23 May 2023Letters to 89,470 people: names, addresses, account numbers. No SSNs or birthdates. (Maine AG filing via JD Supra)Confirmed

Last updated November 13, 2026. Every entry is dated and linked to its source; claims by attackers are labelled as claims, never stated as fact.

Franklin Templeton incident timeline, in detail

Confirmed = acknowledged by Franklin Templeton, a regulator filing or a court. Reported = credible reporting Franklin Templeton has not fully confirmed. Unverified claim = an attacker or leak-site claim.

Jan-May 2023ConfirmedThird-party / file-transfer software

GoAnywhere hack at document vendor InvestorCOM exposes 89,470 Franklin Templeton Canada clients

What happened. InvestorCOM, a Canadian regulatory-communications vendor that prints and delivers investor documents, said on 1 May 2023 that there had been unauthorized access to the SFTP system hosting its GoAnywhere application. BankInfoSecurity linked it to the GoAnywhere flaw CVE-2023-0669 and reported that the compromise happened on 30 January, InvestorCOM found it on 22 March and told Franklin Templeton Canada on 4 April. The same vendor hack affected other Canadian fund firms.

Impact. Franklin Templeton Canada’s Maine AG filing, as summarised by JD Supra, lists 89,470 people and names, addresses and Franklin Templeton account numbers. Letters went out on 23 May 2023. Franklin Templeton said none of its systems were breached, access was limited to data it had given InvestorCOM, SSNs and birthdates were not taken, and investor holdings were not affected.

Sources: InvestorCOM statement, 1 May 2023 · JD Supra via The Wealth Advisor, May 2023 · BankInfoSecurity breach roundup, 25 May 2023

Where the reports disagree

  • Timeline: BankInfoSecurity reports the compromise as 30 January and discovery as 22 March 2023; InvestorCOM’s own statement gives no dates. The 4 April date is when Franklin Templeton Canada says it was told.
  • Scale: InvestorCOM said only “a small number” of its Canadian clients (firms) were affected; Franklin Templeton alone notified 89,470 individuals. Both can be true: the vendor counted client firms, Franklin Templeton counted people.

The pattern across the record

Document and mailing vendors hold the client list

Fund firms send statements and regulatory documents through outside print-and-mail vendors. Those vendors hold names, addresses and account numbers for the whole client base, which is what leaked here.

Mass exploitation of file-transfer tools

GoAnywhere in early 2023 and MOVEit months later were both file-transfer products exploited at scale. Firms that never ran the software were exposed through vendors that did.

What it means for Franklin Templeton clients — and what to do

If you were a Franklin Templeton Canada client in 2023, the leaked data was enough to make a phishing letter or call look real, but not enough on its own to open credit in your name.

  1. 1.Be wary of messages that quote your account number

    An account number and address make a fake “Franklin Templeton” letter or call convincing. Call the number on the official website before acting.

  2. 2.Read the breach letter closely

    Check who sent it, what data it lists and whether monitoring is offered. Vendor-caused letters often come from the fund firm, not the vendor.

    Breach notice decoder
  3. 3.Strengthen your online account sign-in

    Use a unique password and the strongest sign-in option available so a leaked account number cannot be paired with a guessed password.

    Phishing-resistant MFA planner

CISO takeaways

Ask vendors what file-transfer tools they run

GoAnywhere and MOVEit reached firms through their suppliers. Ask which MFT products hold your data and how fast they patch.

Vendor Risk Scorecard
Practise the vendor-told-us call

Run the first days of a supplier breach: scoping, regulators, client letters.

Vendor Breach Lab
Map notification deadlines across countries

This incident touched Canadian clients and a US state filing. Map the clocks before you need them.

Notification clock calculator

Sources

Company statements and regulator filings first, then reputable reporting. Reviewed November 13, 2026.

  1. 1.InvestorCOM Statement: cyber incident — InvestorCOM, 1 May 2023
  2. 2.Franklin Templeton Investments announces data breach following cyberattack at third-party vendor — The Wealth Advisor (JD Supra), 28 May 2023
  3. 3.Breach Roundup: Patch Barracuda ESG appliances ASAP — BankInfoSecurity, 25 May 2023

Frequently asked questions

Was Franklin Templeton hacked?

Not its own systems, as far as the public record shows. In 2023 its Canadian arm’s document vendor, InvestorCOM, was hacked through the GoAnywhere file-transfer flaw, exposing 89,470 clients’ names, addresses and account numbers.

What data was exposed in the Franklin Templeton data breach?

Names, addresses and Franklin Templeton account numbers, per the Maine AG filing as reported by JD Supra. Franklin Templeton said Social Security numbers and birthdates were not obtained and investor holdings were not affected.

How many people were affected?

89,470 people, according to Franklin Templeton Canada’s filing with the Maine Attorney General.

Was Franklin Templeton part of the MOVEit breach?

We found no notice tying Franklin Templeton to MOVEit. Its 2023 incident came through a different file-transfer product, Fortra GoAnywhere, at its vendor InvestorCOM.

Is there a Franklin Templeton data breach settlement?

We found no settlement naming Franklin Templeton in the sources we read. Canadian reporting (seen in search results) mentioned a class action over the wider InvestorCOM breach; we could not open it to confirm the defendants.

More in the Breach Index

Same sourced, verification-tagged timeline, company by company — compare how peers have fared.

Coinbase data breachFinancial services

Bribed support agents, 69,461 customers, an 8-K.

TransUnion data breachFinancial services

4.4M people via a third-party support app (2025).

Apollo Global Management data breachFinancial services

Social engineering and cloud platforms.

Invesco data breachFinancial services

No confirmed breach; 2024 vendor ransomware in Japan

Or see the full Breach Index and how to read it.

Independent analysis for security-leadership education; not affiliated with or endorsed by Franklin Templeton. Facts are attributed to the dated sources above, and anything disputed or unconfirmed is labelled as such. See the full Breach Index.