Tradier Brokerage data breach investigation (Etna Software vendor attack)

Tradier Brokerage customers are getting notices that their names, contact details and possibly Social Security numbers may have been exposed in a cyberattack on one of the brokerage's technology vendors. The attack hit Etna Software Corporation, which runs the order management system and pre-trade controls Tradier uses, on August 28, 2026.

Tradier says its own network stayed secure. State filings reported by law firms and breach trackers list 9,404 affected Texas residents and 1,580 in Massachusetts, and Tradier also filed a notice with the California Attorney General. No nationwide total has been published.

At least one law firm is investigating possible class action claims. Class Action Pulse found no filed lawsuit as of November 2, 2026. This page explains what happened, who may be affected and what customers can do now.

Tradier Brokerage, Inc. is an online broker-dealer based in Charlotte, North Carolina. Its notice says it "holds ultimate responsibility" for the affected information.

Etna Software Corporation provides the order management system and pre-trade controls Tradier uses to run its brokerage business. Its systems held some data used to identify accounts.

Edelson Lechtzin LLP, a class action firm in Newtown, Pennsylvania, announced on October 30, 2026, that it is investigating data privacy claims on behalf of affected people. ClaimDepot, a claim intake site, has also posted an investigation page.

No court case exists yet, so there are no named plaintiffs, defendants or case number.

According to Tradier's notice letter filed with the California Attorney General:

• Tradier learned on September 3, 2026, of an attack against Etna. The California filing lists August 28, 2026, as the breach date.
• Tradier says its own network remained secure, but some data Etna needed for account identification may have been accessed without authorization.
• The data that was, or is reasonably believed to have been, accessed may include full names, addresses, phone numbers and other personal information, possibly including Social Security numbers or similar government tax ID numbers.

The California posting appeared in late October 2026, more than seven weeks after Tradier learned of the attack. Law firm and tracker pages say Tradier notified customers by email.

The notice does not say how the attackers got in, who they were or whether other Etna clients were affected. One breach tracking site lists Etna as a victim claimed by a ransomware group that says it took about 90 gigabytes of data. Class Action Pulse could not verify that claim.

Tradier says it "deeply regrets that this incident occurred." It says it is reviewing affected accounts together with Etna, reviewing its third-party relationships and reviewing its data minimization program.

The investigating firm says Social Security and tax ID numbers are among the most sensitive kinds of personal data, which raises the risk of identity theft and financial fraud. Its investigation focuses on whether affected customers have legal claims. That is a law firm's position, not a finding.

Etna has not issued a public statement that Class Action Pulse could find.

No lawsuit has been filed, so no court has decided anything. No one has found that Tradier or Etna failed to protect customer data or owes anyone money.

People most likely to be covered by any future case:

• Tradier Brokerage customers who received the data incident notice.
• Customers whose personal information was held in the Etna systems Tradier uses.
• People whose notice lists a Social Security number or tax ID number.

No class has been defined, and the investigating firm sets its own intake criteria.

1. Enroll in the free monitoring. Tradier offers up to two years of credit monitoring and identity protection. Law firm and tracker summaries say the provider is Cyberscout, a TransUnion company, and that you must enroll within 90 days of your notice.
2. Freeze your credit at Equifax, Experian and TransUnion. A freeze is free and blocks new accounts in your name.
3. Review your brokerage and bank statements and report anything unusual to Tradier right away.
4. Watch for phishing. Criminals with your name and phone number may pose as Tradier or a bank.
5. Keep your notice and records of any fraud, time spent or costs.

Nothing is owed now. The only benefit available is the free monitoring Tradier offers. If a lawsuit is filed and later settles, data breach settlements commonly offer repayment of documented losses, payment for lost time or a cash payment, plus more monitoring. Any of that would require a filed case and court approval.

• August 28, 2026: Attack on Etna, per the California filing.
• September 3, 2026: Tradier learned of the attack.
• Late October 2026: Notice filed with the California Attorney General.
• October 30, 2026: Edelson Lechtzin LLP announced its investigation.
• 90 days from your notice: Reported deadline to enroll in monitoring.

You do not give up any rights by enrolling in the monitoring. Breach claims have time limits that vary by state.

• Broker-dealer: A firm that buys and sells securities for customers.
• Order management system: Software that routes and tracks trade orders.
• Pre-trade controls: Automatic checks that run before an order is sent to the market.
• Third-party vendor breach: An attack on a company's service provider rather than the company itself.
• Credit freeze: A free lock on your credit file that stops new credit in your name.

Law firms usually gather affected customers before filing a complaint. A lawsuit could name Tradier, Etna or both. More state filings may also reveal a nationwide total. Class Action Pulse will update this page if a case is filed or more details come out.

This page relies on Tradier's notice letter posted by the California Attorney General, the Edelson Lechtzin LLP announcement and ClaimDepot's summary. The Texas and Massachusetts counts and the monitoring provider come from those secondary sources, because the attachment to the notice was not machine-readable and the state portals were not checked directly. The ransomware claim is unverified.

Class Action Pulse is not a law firm or settlement administrator and does not guarantee eligibility or payment. This article is general information, not legal advice.