Tr?id=566623520170033&ev=PageView&noscript=1

Massachusetts Regulators Fine Fidelity $1.25 Million Over Data Breach Allegations

Posted on June 1st, 2026 at 11:49 AM
Massachusetts Regulators Fine Fidelity $1.25 Million Over Data Breach Allegations

From the desk of Jim Eccleston at Eccleston Law

Massachusetts regulators has fined Fidelity Brokerage Services $1.25 million over allegations that the firm failed to adequately protect customer information and properly notify all affected individuals following a significant data breach.

According to reporting by AdvisorHub, the parties reached a settlement pursuant to a consent order. That consent order reveals that Fidelity's cybersecurity failures allowed an unauthorized third party to access sensitive information belonging to approximately 77,000 customers. At least 2,768 Massachusetts residents were affected by the breach.

Fidelity accepted the consent order without admitting or denying any wrongdoing.

The consent order stated that, over a three-day period in August 2024, an unidentified third party accessed and obtained images containing highly sensitive customer information. The compromised records reportedly included Social Security numbers, financial account information, active credit card numbers, medical information, passports, and driver's license data.

Regulators also alleged that the compromised documents included personal information belonging to beneficiaries, relatives, and minors connected to customer accounts. According to AdvisorHub, although Fidelity notified certain impacted customers, regulators claimed the firm failed to notify all affected individuals whose information appeared in the exposed documents.

According to the consent order, the unauthorized access stemmed from a vulnerability in Fidelity's online access controls. Regulators alleged that the third party manipulated a ten-digit "Image ID" displayed within the browser while viewing customer documents, allowing access to records associated with other users, as reported by AdvisorHub.

The firm declined to comment on whether the breach affected customers affiliated with registered investment advisory firms or whether the incident remained limited to self-directed brokerage accounts.

According to AdvisorHub, this enforcement action is one of several as multiple brokerage firms continue to face scrutiny over cybersecurity incidents and client data breaches.

Eccleston Law LLC represents investors and financial advisors nationwide in securities, employment, transition, regulatory, and disciplinary matters.

Tags: eccleston, eccleston law, data breach, financial regulation, cybersecurity law, data privacy, regulatory fines

Return to Archive

TESTIMONIALS

Previous
Next
Quotes Bigger

If the regulators are after you, and are trying to make a case against you, and you are going to contest their allegations against you, make sure you have the best securities industry defense lawyers, Eccleston Law Firm. My case was spun into a combination of penalties including fines, cash settlements, CE courses and suspension. They were the best I have seen in action. When all was said and done, they had done their magic, my situation was negotiated and settled with a simple "letter of caution" and a case closed without action. It is the most important legal business decision you will ever make, make it Eccleston Law.

Rick R.

LATEST NEWS AND ARTICLES

1787342003 Law
August 21, 2026
Rising Market Leverage Raises Concerns About Financial Stability Despite Low Volatility

The leverage that has helped drive the U.S.

1787244289 Law
August 20, 2026
FinCEN Imposes Record $125 Million Penalty on UBS Financial Services

The Financial Crimes Enforcement Network (FinCEN) has imposed a $125 million civil money penalty against UBS Financial Services Inc.

1787157891 Law
August 19, 2026
Former UBS Financial Advisor Suspended and Fined Over Unauthorized Trading Allegations

The Financial Industry Regulatory Authority (FINRA) suspended a former UBS Wealth Management USA broker for three months and fined him $10,000 after finding that he executed hundreds of trades in two customers' accounts without the required written authorization.