Charles Schwab Corp., the parent company of TD Ameritrade, Inc., has disclosed that it is just the latest company to suffer a data breach resulting from vulnerabilities found in MOVEit file transfer software. While the company claims that the computer systems of both companies remains unharmed, customer data stored on Ameritrade's MOVEit server was compromised.
The incident is currently under investigation by both Schwab and Ameritrade, with a thorough analysis expected to be completed soon. Upon conclusion, Schwab says, affected customers will be notified.
This data breach holds significant implications, as it contributes to one of the largest breaches of 2023, affecting millions of Americans. The compromised information puts individuals at an increased risk of identity theft and other fraudulent activities. It is crucial for customers who receive a data breach notification from TD Ameritrade or Charles Schwab to understand the potential risks and take appropriate measures.
The cause of the breach stems from vulnerabilities discovered in the MOVEit software, which TD Ameritrade used on a limited basis. The incident came to light after the software's developers detected a zero-day vulnerability.
Promptly responding to the potential security breach, TD Ameritrade ceased using MOVEit and promptly informed law enforcement. Simultaneously, an investigation was initiated to determine the scope of the breach and the specific client data that may have been exposed. Although this investigation remains ongoing, Schwab estimates that approximately 0.5% of Ameritrade's clients may have been affected. That could mean up to 55,000 clients have been affected.
In a release, Schwab emphasized its commitment to providing regular updates to clients as new information emerges, ensuring direct communication with affected individuals. It is anticipated that one of the two companies will issue data breach letters to impacted customers in the near future.
The MOVEit hack has already claimed some big scalps — the biggest U.S. pension fund, Calpers, and Genworth Financial have both said that clients personal information has been compromised.
Some of the companies that have been affected by the MOVEit hack already:
1st Source Bank
First Merchants Bank
Deutsche Bank
ING
Commerzbank
TD Ameritrade
Shell PLC
British Airways
Radisson Hotels
Jones Lang LaSalle
UofL Health
Tom Tom
U of Colorado
Russian-based group Cl0p, which who claimed responsibility for the attack, has already published Shell’s data to the dark web after the company failed to pay a ransom — there is no indication yet what fate awaits TD Ameritrade.
Rick Hu of Midas Wealth breaks down the fee-based planning shift that transformed his advisory practice and reshaped client relationships
Formulating a vision, heading off infrastructure and resource bottlenecks, and deciding on a flexible "True North" are essential early steps in the increasingly competitive advisory business.
New York Life research finds AI is pushing Gen Z toward financial professionals, not away from them.
Private equity lifted modeled retirement wealth by 13%, but CFA Institute warns that glide-path design may matter more
The products in question were a mix of sophisticated, complex and potentially volatile offerings.
As AI makes financial information more accessible than ever, Lana Hock explains why human judgment, trust, and empathy remain the qualities clients value most in a financial advisor
Northern Trust’s Ken Lassner shows advisors how to convert volatility into after-tax portfolio gains
