If you were affected, free legal review is available — no obligation.
Learn how to participate in the class action and what compensation you may be entitled to.
Join the Class Action →Use our verification tool to confirm your letter matches this official AG filing.
Verify My Notice LetterThis case file references a public filing made with the state filing in TX. This website is not affiliated with, endorsed by, or operated by any state government agency.
Cetera Financial Group was the subject of a data breach notification filed with the TX Attorney General. The AG filing was recorded on March 27, 2026. The breach or discovery date reported in the filing is July 7, 2025.
From the AG filing description
Cetera Financial Group operates as a prominent wealth management hub and network of independent broker-dealers, providing comprehensive financial planning, investment advisory, and securities brokerage services to clients nationwide. Because of their core function in managing individual wealth, retirement accounts, and financial portfolios, institutions of this scale routinely collect and maintain an immense volume of highly sensitive personal and financial data. This information is essential for executing investment strategies, managing tax-advantaged accounts, and complying with stringent federal financial regulations, making these platforms vast repositories of lucrative personal data. The security incident reported by Cetera Financial Group to the Texas Attorney General in 2026 highlights the ongoing vulnerabilities facing financial institutions in an increasingly digitized economy. While the exact vector remains under investigation, cyberattacks targeting financial services firms typically involve sophisticated unauthorized access to internal databases, compromise of third-party vendor platforms, or targeted ransomware deployments designed to extract proprietary and consumer data. In the wealth management sector, threat actors aggressively target network perimeters to exploit legacy software, credential vulnerabilities, or administrative misconfigurations, aiming to harvest confidential client portfolios and personally identifiable information. The exposure resulting from this breach places affected individuals at severe and immediate risk of identity theft, financial fraud, and targeted social engineering schemes. Because financial institutions maintain deep records containing sensitive identifiers, compromised individuals face threats such as unauthorized wire transfers, fraudulent account openings, and the exploitation of tax documents. When malicious actors obtain foundational identity components alongside banking details, they can effortlessly bypass multi-factor authentication protocols, liquidate investment holdings, or execute unauthorized transactions across multiple financial platforms, causing profound and lasting economic devastation. As a financial institution, Cetera Financial Group is bound by rigorous regulatory frameworks, most notably the Gramm-Leach-Bliley Act (GLBA) and its accompanying Safeguards Rule, alongside state-level data protection statutes and FTC guidelines. These legal obligations mandate the implementation of robust administrative, technical, and physical safeguards to protect non-public personal information against unauthorized disclosure. The occurrence of a data breach of this magnitude serves as a strong indicator that the company may have failed to maintain adequate security controls, encryption standards, or timely vulnerability patching, thereby breaching its legal duty of care to its clients. Receiving a formal data breach notification letter from Cetera Financial Group serves as an official admission that your confidential information was compromised due to corporate security shortcomings. Legally, the receipt of this notice establishes the necessary standing to participate in a class action lawsuit aimed at holding the company accountable for its negligence. You do not need to wait until you experience actual financial theft or fraudulent charges to seek legal recourse; the increased risk of future identity theft alone is legally actionable. Our firm handles these complex class action cases on a strict contingency fee basis, meaning you pay absolutely nothing out of pocket and owe no legal fees unless we successfully recover compensation on your behalf. As one of the larger networks operating within the independent financial advisor space, a security lapse at Cetera Financial Group carries systemic implications for thousands of investors and clients across Texas and the United States. The breach underscores the critical need for heightened accountability within the wealth management sector, where the centralization of vast financial wealth makes institutions primary targets for sophisticated cybercriminal organizations seeking to monetize stolen identities and banking credentials.
Under the Texas Identity Theft Enforcement and Protection Act, you may have a legal claim against Cetera Financial Group if any of the following apply:
Based on the data types reported in this filing:
Your SSN is the master key to your identity. Once exposed, criminals can open new lines of credit, take out loans, or file taxes in your name.
Combined with a name and other leaked data, date of birth helps criminals pass identity verification questions at banks and government agencies.
Phone numbers exposed in breaches are used for SIM swapping attacks — hijacking your number to bypass two-factor authentication on financial accounts.
Common categories of compensation in data breach class actions
Courts recognize that the time spent monitoring accounts, placing credit freezes, and dealing with the aftermath of a breach has real economic value. This category of damages is recoverable even without direct financial loss.
Professional credit monitoring services cost $10–$40 per month. Identity theft restoration services, if needed, can cost hundreds of hours and thousands of dollars. Courts have awarded these costs as direct damages in SSN breach cases.
Direct financial losses resulting from the breach — unauthorized charges, fraudulent transfers, or fees incurred through fraud — are recoverable as compensatory damages. Banks may reverse some charges; a class action recovers the remainder and associated costs.
Several state data breach laws provide for statutory minimum damages — fixed amounts recoverable per affected individual regardless of actual loss. These provisions exist specifically to make legal action viable for victims who have not yet experienced direct harm.
Note: an attorney general breach filing does not by itself establish a settlement fund, a payment amount, or a claim deadline. If an official settlement notice is later issued, rely on that notice for payment details and deadlines.
No. Under Texas Identity Theft Enforcement and Protection Act and federal law, the unauthorized exposure of your personal data — regardless of whether it has been actively misused — can be sufficient grounds for a claim. The breach itself is the injury.
Nothing. The Law Office of David S. Harris handles data breach cases on contingency — you pay zero upfront and owe nothing unless compensation is recovered.
Immediately place a free credit freeze at all three bureaus (Equifax, Experian, TransUnion). A freeze blocks new accounts from being opened in your name. Then file a complaint with the FTC at IdentityTheft.gov and contact our office — SSN exposure is one of the most serious breach types.
Banks may reverse fraudulent charges, but they are not obligated to compensate you for time lost, stress, or indirect damages. A class action claim against the breached company can recover those additional categories of harm.
State statutes of limitations for data breach claims typically run 2–4 years from the date of the breach or its discovery. Because this breach was recently disclosed, the window is open — but acting early preserves your options and strengthens the case.
Accepting free credit monitoring from Cetera Financial Group does not waive your right to pursue legal action unless you signed a specific release waiving claims. In most cases, victims who accepted monitoring can still file.
Not necessarily. Many data breach victims are never notified directly. If your personal information was held by Cetera Financial Group during the relevant period, you may still qualify even without receiving a letter. A free eligibility review can confirm your status.
Applicable State Law
This breach was reported under the Texas Identity Theft Enforcement and Protection Act, which mandates notification and establishes your right to seek damages.
Cetera Financial Group breach?
Free case review · No fee unless you win