Ameriprise ameriprise.com Ameriprise data breach 2026: what happened and what to do
Attackers accessed Ameriprise Financial data from 2 March 2026 until the company blocked them on 18 March. Have I Been Pwned lists 502,597 accounts, with names, emails, phones, addresses, employers, job titles and financial transactions exposed.
View all 13,115 breaches- Breach date
- 2 Mar 2026
- Made public
- 17 Apr 2026
- Affected
- 502,597
- Data exposed
- Email addresses, Employers, Financial transactions, Job titles, Names, Phone numbers, Physical addresses
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
Ameriprise Financial, the US wealth management firm, had stored company data accessed by an unauthorized party in March 2026. Have I Been Pwned (HIBP) gives a breach date of 2 March 2026, added the data on 26 May 2026, and counts 502,597 accounts.
What happened
Ameriprise's notices describe unauthorized access to stored company data and files. The company said the intrusion began on 2 March and was blocked on 18 March. Letters went to affected people on 17 April 2026.
HIBP says the group ShinyHunters named Ameriprise in a pay-or-leak extortion campaign. Ameriprise hasn't confirmed that attribution.
Two different counts exist, and they measure different things. Ameriprise reported 47,876 affected people to state regulators, according to coverage of the notices. HIBP counts 502,597 accounts in the data that circulated. This page uses HIBP's number when describing the breach data.
What was exposed
HIBP lists email addresses, employers, financial transactions, job titles, names, phone numbers and physical addresses. Ameriprise's letters said the information varied by person and may have included name, address, account number, date of birth and Social Security number.
If you received a letter, it names what applied to you. If you didn't, the HIBP list is the better guide.
What that lets criminals do
A name, address and date of birth are the core of identity theft. With a Social Security number, a criminal can try to open credit in your name or file a fraudulent tax return. A financial account number and a financial advisor relationship make a convincing phishing pretext: a message that appears to come from Ameriprise about a transfer or a statement.
Phone numbers and emails also allow smishing, which is phishing by text message.
The company's response
Ameriprise blocked the intruder, brought in external cybersecurity experts to investigate and offered free identity protection services to affected customers. It said there were no unauthorized transactions or movement of funds and that business operations continued.
If you're an Ameriprise client
Read any letter you got from Ameriprise and take the identity protection offer if it includes one. Review your account statements monthly, and don't act on messages about transfers without calling Ameriprise on a number you already have.
How to check your own exposure
Start with the letter. If Ameriprise mailed you one, it lists which items of yours were involved, and that decides how far to go. If your Social Security number was named, place the credit freezes now. If only contact details were involved, focus on phishing. Search your email on Have I Been Pwned too, because HIBP's entry covers a wider set of data than the regulator filings. Keep the letter and the dates in a safe place, in case you need to show when you were notified.
What to do if you were in it
- 1
Freeze your credit at all three bureaus
A free credit freeze at Equifax, Experian and TransUnion stops new credit being opened in your name. It is the most useful step if your Social Security number or date of birth was involved.
- 2
Review your accounts and statements
Check your Ameriprise and bank accounts for transactions you don't recognize, and set up alerts on them.
- 3
Expect phishing that mentions the breach
Treat unexpected emails, texts and calls with suspicion, especially ones that quote your name, phone number or the company. Don't click links in them. Go to the company's site yourself, or call the number printed on a card or a bill.
- 4
Use the identity protection offered
If Ameriprise sent you a letter with free identity protection, enrol using the instructions in the letter, not links from an email or text.
- 5
Check whether your email or phone is in this and other breaches
Run a free scan at Serus to see which breaches include your email address or phone number. Breach data can't be taken back once it's out, so the scan tells you what to change and where to stay alert.
Frequently asked
Was I affected by the Ameriprise data breach?
If you got a letter from Ameriprise, yes. You can also check your email on Have I Been Pwned, which lists 502,597 accounts, or run a Serus free scan.
What was exposed in the Ameriprise breach?
HIBP lists email addresses, employers, financial transactions, job titles, names, phone numbers and physical addresses. Ameriprise's letters also mentioned account numbers, dates of birth and Social Security numbers for some people.
Why do the numbers differ?
Ameriprise reported 47,876 affected people to regulators. HIBP counts 502,597 accounts in the data that circulated.
Should I freeze my credit?
A credit freeze is free and is a sensible step if your Social Security number or date of birth may have been exposed.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
