Fidelity Investments data breach 2024: what happened and what to do

What happened

Fidelity Investments, the US financial services company, told regulators that between August 17 and August 19, 2024 an unauthorized third party got access to customer information through two customer accounts. Fidelity found the activity on August 19 and shut it down. It began notifying people in October 2024.

Press reports on the state filings say 77,099 people were affected in total. The count in Massachusetts alone was 2,768 residents, so a state-level number is not the total. Fidelity said the incident did not involve any access to customer accounts or funds. It also said it had not found any misuse of the information. Security Affairs reported it as the second breach Fidelity disclosed that year.

What was exposed

The filings and the coverage of them don't agree on the list. One report of the Massachusetts filing mentions Social Security numbers and access to financial account information, while other coverage says Fidelity did not specify what was taken. Because the sources conflict, this page doesn't list data types. If you got a letter, it names what applies to you, and that is the list to trust.

What it means for you

If you are a Fidelity customer, the practical risk comes from who has your data and what they know about your finances. Anyone holding your name and account relationship can phone you pretending to be Fidelity's fraud team, and those calls work best when the caller sounds informed. Fidelity will never need you to read out a one-time code, and legitimate staff won't ask you to move money to a "safe account".

If your Social Security number was in the data, the risk is longer. A stolen SSN can be used years later to open credit in your name, which is why a credit freeze matters more than a password change in that case.

What Fidelity has said

Fidelity said it would offer affected customers two years of credit monitoring and identity restoration services, and advised people to remain vigilant for fraud. Notification letters went out from October 2024. If you didn't get a letter, you probably weren't among the 77,099.

Check your own exposure

Your Fidelity notice is the main source. For everything else, Have I Been Pwned lists breaches that involved your email address, and a free Serus scan checks your email and phone number against breaches and keeps watching. Serus can't remove data from a breach, but it alerts you when your details show up somewhere new.

A note on the count

The 77,099 figure comes from the filing with Maine's attorney general, as reported by the press. State attorney general sites each show only their own residents, which is why different pages show different numbers for the same incident. If you are searching the state lists for your own name, remember that none of them publish individual names.