Fidelity data breach: the 2023 and 2024 incidents and your next steps

When people search for "Fidelity data breach," they often land on a mix of stories. The public record shows two separate events. They happened a year apart, in different systems, and the notices went to different groups of people. This page keeps them apart so you can tell which one, if either, applies to you.

What was made public

The 2023 vendor incident. According to the notice Fidelity Investments Life Insurance Company filed with the California Attorney General, a third-party service provider called Infosys McCamish (IMS) had a cybersecurity event. IMS helped administer certain life insurance policies. The notice says that between October 29, 2023, and November 2, 2023, an unauthorized third party gained access to certain IMS systems and obtained data stored there. IMS told the insurer in early November 2023, and the insurer says it received people's information from the holder of a policy it had issued.

Infosys described the same event in a filing with the Securities and Exchange Commission. It says ransomware encrypted systems at Infosys McCamish Systems in November 2023. In an article dated March 7, 2024, SecurityWeek reported that a notification letter was submitted to the Maine attorney general's office and that just over 28,000 people were affected. I could not open the Maine filing itself, so treat that figure as press reporting from that date.

The August 2024 incident. This one happened at Fidelity itself. A letter Fidelity's outside counsel sent to the Iowa attorney general on October 9, 2024 says a third party obtained documents by submitting fraudulent requests to an internal database that held images of documents about Fidelity customers. Fidelity's customer letter says the person used two customer accounts they had recently established. The access ran from August 17 to August 19, 2024. Fidelity says it detected the activity on August 19 and disabled the two accounts.

Fidelity says it finished reviewing the documents on October 3, 2024, and began mailing notices on October 9, 2024. The Iowa letter reports 561 Iowa residents. TechCrunch, in an article dated October 10, 2024, reported that a filing with the Maine attorney general put the total at 77,099 customers. Again, that total is press reporting of a state filing that I could not open directly.

Who may be affected and how to find out

Both companies say they notified people by U.S. mail. That means a paper letter is the clearest sign. If you received one, it should say which incident it describes.

If you never got a letter, you can still ask. Use the phone number on your account statements or the number printed on the official Fidelity website. The IdentityTheft.gov guidance for stolen financial information recommends using a phone number or website you know is real, such as the number on your statements, to avoid scammers.

Do not reply to an email or text that claims to be about the breach, and do not click its links. Breach notices are a favorite hook for scammers.

Fidelity's notice for the August 2024 incident included a toll-free number and a mailed enrollment code for credit monitoring. Both companies' letters said enrollment was optional and free.

What data was involved

The two notices list different things.

For the 2023 vendor incident, the sample notice filed in California lists "name and" a placeholder for the data elements that vary by person, so the template does not tell you what your letter says. SecurityWeek, describing the notification letter, reported names, dates of birth, state of residence, Social Security numbers, bank account and routing numbers, and credit card numbers. Fidelity also said at the time that its investigation was ongoing.

For the August 2024 incident, the letter to the Iowa attorney general says the documents included one or more of the following: birth date, Fidelity account number, Fidelity routing number, non-Fidelity account number, non-Fidelity routing number, and Social Security number. TechCrunch reported that a Massachusetts filing also cited driver's licenses.

Fidelity said, for the August 2024 incident, that the incident did not involve access to the recipient's Fidelity accounts, and that the third party did not gain access to customer accounts or funds. For the 2023 vendor incident, the notice says Fidelity was not aware of any misuse of personal information at the time of writing.

What to do now

The FTC's IdentityTheft.gov has a page for exactly this situation. Its first step is to check, freeze, and monitor your credit.

1. Get your free credit reports at AnnualCreditReport.com. IdentityTheft.gov says you can check them online every week for free. If you see an account or debt you do not recognize, contact the company and ask about it.
2. Consider a credit freeze. The FTC says that while a freeze is in place, nobody can open a new credit account in your name. It is free to place and to lift, and it lasts until you lift it. You contact Equifax, Experian, and TransUnion separately.
3. Know the lighter option. A fraud alert is also free. The FTC says an initial fraud alert lasts one year, and you place it with one bureau, which must notify the other two.
4. Use the monitoring offer if you want it. IdentityTheft.gov advises accepting free credit monitoring when a company offers it. Check the enrollment instructions and dates in your own letter, because those deadlines may have passed.
5. If your Social Security number was included, IdentityTheft.gov suggests reviewing your Social Security work history by creating an account at SSA, and trying to file your taxes early. It also mentions E-Verify's option to lock your number.
6. If bank or investment account numbers were included, IdentityTheft.gov says to contact your bank or investment company, tell them what happened, and consider closing the account and opening a new one. Review transactions regularly and update any automatic payments if the account changes.
7. Change passwords and turn on multi-factor authentication. The FTC says to change the password you use with the company and on accounts with a similar password. A password manager can create unique ones. This matters even when a notice says logins were not involved, because reused passwords are a separate risk.

If someone has already used your information, report it at IdentityTheft.gov. For scams and fraud attempts, you can also report them at ReportFraud.ftc.gov.

Watch for phishing after a breach

Notices like these tell scammers that a person is worried about a particular company. Expect messages that look official. The FTC says phishing messages often claim there is suspicious activity or an account problem, and that legitimate companies will not email or text a link asking you to update payment information.

If a message appears to come from Fidelity, do not click. Open the company's site by typing the address yourself, or call the number on your statement. The FTC says you can forward phishing emails to reportphishing@apwg.org and forward phishing texts to 7726 (SPAM). If you think a scammer may already have your Social Security, card, or bank account number, the FTC points you to IdentityTheft.gov for steps based on what was exposed.

Settlements and lawsuits

Both incidents led to class action lawsuits. Deadlines move and often pass, so confirm everything on the official site or in your notice. I am not offering any estimate of what anyone might receive.

For the August 2024 incident, the official settlement website names the case as In re: Fidelity Investments Data Breach Litigation, No. 1:24-CV-12601-LTS, in the U.S. District Court for the District of Massachusetts. It says Fidelity denies wrongdoing and the court had not decided the case. Its FAQ describes a $2,500,000 settlement fund, with court-approved fees, costs, service awards, and administration costs paid first. The benefits it lists include reimbursement for documented losses with a stated cap, a cash payment option whose amount depends on total claims, and credit monitoring. The pages I read listed a claim deadline of July 27, 2026, an opt-out and objection deadline of June 26, 2026, and a final approval hearing on July 9, 2026. Those dates have passed. The pages I read did not say whether the court approved the settlement, so check the site for the current status.

For the 2023 vendor incident, Infosys told the SEC that the parties reached an agreement in principle on March 13, 2025, under which McCamish agreed to pay $17.5 million into a fund, and that the court granted final approval on December 18, 2025. The filing says the settlement becomes effective if not appealed within 30 days. It does not say whether people notified by Fidelity Investments Life Insurance Company are part of that class, so rely on the notice you received and the administrator's official site rather than this page.

Check your email against known breaches

A notice letter covers one company's incident. Your email address may also appear in other breaches. The free scan on this site checks whether an email address shows up in known breaches, using Have I Been Pwned and LeakCheck, and shows any passwords masked. It does not detect this particular Fidelity incident, and an empty result is not proof that nothing has been exposed.