DriveWealth's September intrusion exposes customer data at Stake in Australia and Hatch in New Zealand
DriveWealth's systems were accessed on 4 and 5 September, exposing contact details and account balances of Stake and Hatch customers, the brokers say. Stake says DriveWealth serves several Australian platforms, so one intrusion reaches customers of competing apps.
The Investor · Invest desk
What happened
- DriveWealth provides execution, custody and clearing for Stake Wall St and holds the personal details Stake passes to it when a customer opens an account.
- DriveWealth investigated with independent cybersecurity experts, found no ongoing threat and has strengthened its controls, according to Hatch.
- Stake says login credentials, tax file numbers, bank details and identity documents were not accessed, and Hatch gives a similar list covering IRD numbers.
- The exposed fields differ by broker: Stake lists tax status, account numbers and buying power, while Hatch lists income and net asset ranges.
- Stake notified privacy regulators in Australia and New Zealand, and Hatch told New Zealand Police and the National Cyber Security Centre.
Why it matters
- What it limits constraint A customer who closes a Stake or Hatch account leaves the record behind at DriveWealth, where US retention rules keep it within reach of any later intrusion.
- Who's exposed exposure With contact details and balances in the same records, scammers can pick out the customers holding the most money, and that risk lasts after DriveWealth's fixes.
- Who has to decide decision What an app sends DriveWealth at onboarding appears to set what its customers can lose, so how much data to share is a choice each local broker controls.
- What it costs cost Stake is paying outside legal and cyber security advisers to handle an incident that happened inside a partner's environment.
Next story · Invest · 2d ago
DriveWealth to use Ripple's RLUSD on XRP Ledger for settlement, starting in EuropeConfirmed3 publishers
Both brokers say the breach happened outside their own systems. Stake says the incident took place within DriveWealth's environment and that its systems, app and website were not affected [6]. Hatch says its systems were not accessed [4]. Trading carried on throughout. Stake says customers can trade, deposit and withdraw as normal [7], and Hatch passes on DriveWealth's confidence that no unauthorised transactions were made and holdings were not affected [8].
So the shared backend failed at the customer file. Contact details sitting next to a cash balance tell a fraudster which customers to call first. Hatch wrote that the information "could be used to make fraudulent emails, text messages or phone calls more convincing" [13]. When it answers the insurance question, Hatch points to SIPC and FDIC cover for investments and cash held with DriveWealth [22], and those are the assets the notices say came through intact [8].
The local brand owns the customer relationship and files the regulatory notices, but the investigation belongs to DriveWealth. Stake's page is dated 21 September [5], 16 days after the last day of access Hatch reports [24]. It says DriveWealth's investigation is continuing and that "we are working with them to obtain answers to key questions on behalf of our customers" [18]. Neither broker gives a count of affected customers. Stake says only that not every customer is affected and that it cannot give individual detail on its page [23].
From here the story can go one of three ways. If Stake's monitoring for misuse stays quiet [19] and the field lists hold, the damage stops at what the notices already list. If scams built on those records start to succeed, the cost arrives later and lands on customers of several apps at once [1]. None of that cost would show up as an unauthorised trade. The third route is DriveWealth's continuing investigation widening the lists [18].
I think the first path is the likelier one on the evidence so far, since Stake is watching for misuse and has not reported any [19]. The case against is that a contact list sorted by balance stays valuable to whoever holds it long after the intrusion is closed. Stake has said it will post on its page if its position on misuse changes [19], and such a post would count against this view.
What to watch
- A Stake update reporting misuse of the exposed data, which it has said it will post if its position changes.
- Notices from the other Australian platforms that use DriveWealth, and whether their field lists match Stake's or Hatch's.
- Any view from the Australian Information Commissioner or New Zealand's Privacy Commissioner on local brokers' duties for data held by an offshore partner.
Information, not investment advice. This story is general information about companies and markets, drawn from cited reporting. It is not a recommendation to buy, sell or hold any security; check the cited sources before acting.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+10
- Incentives65
- Confidence55
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
DriveWealth, the partner that supports U.S. trading and wallet functionality for several Australian investing platforms including Stake, has experienced a cyber incident.
- [2]
When customers open a Stake Wall St account, Stake passes certain personal information to DriveWealth so it can open and maintain the customer's US trading account; DriveWealth provides execution, custody and clearing for Stake Wall St.
- [3]
DriveWealth is the US-regulated broker that Hatch uses to provide access to US markets.
- [4]
DriveWealth advised Hatch that an unauthorised party accessed data held on its systems on 4 and 5 September 2026, including data relating to Hatch customers; Hatch systems were not accessed.
- [5]
Stake's notice is dated September 21, 2026, and says DriveWealth informed it that some personal information belonging to Stake customers was affected.
- [6]
Stake says the incident took place within DriveWealth's environment and that Stake's systems, app and website have not been affected.
- [7]
DriveWealth informed Stake the incident is contained and no unauthorised trading, transfers or withdrawals occurred on any account; customers can continue to trade, deposit and withdraw as normal.
- [8]
DriveWealth is confident that no unauthorised transactions were made and investment holdings were not affected by the incident.
- [9]
For affected Stake customers the information may include name, email, phone and postal address; W-8 or W-9 tax status and country of taxation; DriveWealth account number (the Stake Wall St account number); an aggregate portfolio value snapshot; and a cash balance and buying power snapshot.
- [10]
For Hatch customers the data that may have been exposed includes name, address, phone number and email address; investor profile information such as income range and net asset range; and cash balance and portfolio value.
- [11]
DriveWealth's investigation determined that Stake login credentials and passwords, tax file numbers and government identification numbers, bank account details, identity document details and images, and individual security positions or trading history were not accessed.
- [12]
Hatch says ID documents and date of birth, IRD numbers and foreign tax identifiers, kids account details, and other documents such as source of wealth were not exposed.
- [13]
the information involved could be used to make fraudulent emails, text messages or phone calls more convincing
- [14]
Some people who opened a Stake Wall St account but are not actively using it were affected; DriveWealth is required to retain customer records for as long as the law requires.
- [15]
US regulations require DriveWealth to retain certain information after an account is closed, so closed Hatch customers' information remains on DriveWealth's systems; Hatch has not reopened those accounts.
- [16]
Stake notified the Office of the Australian Information Commissioner and the Office of the Privacy Commissioner in New Zealand, and gave courtesy notifications to other regulatory bodies.
- [17]
Hatch notified New Zealand Police and the National Cyber Security Centre.
- [18]
DriveWealth's investigation is continuing, and we are working with them to obtain answers to key questions on behalf of our customers.
- [19]
Stake is monitoring for any sign that information has been misused and will say so on its page if that position changes.
- [20]
DriveWealth investigated with independent cybersecurity experts, has not identified an ongoing threat to its systems and has strengthened its security controls.
- [21]
Stake has engaged external legal and cyber security advisers to support its response.
- [22]
Hatch says investments and cash held with DriveWealth are protected by SIPC and FDIC insurances.
- [23]
Not every Stake customer is affected and the information differs by person; Stake is emailing affected customers and is not able to provide individual detail on its page.
- [24]
Stake's notice is dated 16 days after the last day of unauthorised access reported by Hatch.
- [25]
The exposed-field lists differ by broker: Stake's includes tax status, account number and buying power, which Hatch's does not list; Hatch's includes income range and net asset range, which Stake's does not list.
Sources
2 independent publishers whose own reporting we read for this story.
- DriveWealth Data Security Incident | Stake
hellostake.com
1 article · September 20, 2026
- DriveWealth cybersecurity incident | Hatch | Help Centre
help.hatchinvest.nz
1 article · September 21, 2026
Topics and entities
Topics
- Data Breach Notification
- Embedded brokerage
- Third-Party and Supply Chain Risk
Entities
- Office of the Privacy Commissioner (New Zealand)
- Office of the Australian Information Commissioner
- National Cyber Security Centre (New Zealand)
- DriveWealth
- Hatch