OneDigital Investment Advisors LLC Data Breach Analysis

OneDigital Investment Advisors Breach Exposes 28,000 Client SSNs Through Salesforce Supply Chain Attack

A third-party software compromise affecting Salesforce and an associated chat tool has exposed the names and Social Security numbers of 28,414 individuals associated with OneDigital Investment Advisors LLC. The Atlanta-based investment advisory firm disclosed the breach on April 8, 2026—nearly eight months after unauthorized access first occurred through a vulnerability in Drift, an online chat agent managed by Salesloft.

The incident highlights a persistent vulnerability in the financial services sector: the expanding web of third-party SaaS platforms that now house sensitive client data far beyond the perimeter of firms' own networks.

Timeline: Eight Months From Breach to Disclosure

The sequence of events reveals a troubling gap between incident occurrence and customer notification:

Date	Event
August 12-18, 2025	Unauthorized actor accesses and copies data from Salesforce via Drift compromise
August 22, 2025	Salesforce notifies OneDigital of the security event
August 2025 - March 2026	Forensic investigation and data review conducted
April 8, 2026	OneDigital begins mailing breach notifications

The 229-day window between breach occurrence and public disclosure raises questions about notification timeliness. While OneDigital characterizes the review as "thorough and time-intensive," state regulators and affected individuals may scrutinize whether the extended timeline meets the spirit of prompt notification requirements.

Maine's breach notification statute requires disclosure "as expediently as possible and without unreasonable delay," with a general expectation of notification within 30 days unless law enforcement requests a delay or investigation complexity justifies extension. The 7.5-month gap from OneDigital's initial notification by Salesforce to customer disclosure sits at the outer edge of defensible timelines.

Data Exposure: SSNs Create Long-Tail Identity Theft Risk

The breach exposed two categories of personally identifiable information:

• Full names
• Social Security numbers

For an investment advisory firm, this combination represents a particularly dangerous exposure. Unlike credit card numbers that can be reissued, Social Security numbers remain static identifiers used across financial account opening, tax filing, employment verification, and government benefits. Clients of investment advisors typically have accumulated assets—making them attractive targets for sophisticated identity theft and account takeover schemes.

The exposed data could enable:

• Synthetic identity fraud: Combining real SSNs with fabricated identity elements
• Tax refund fraud: Filing false returns using stolen SSN/name combinations
• New account fraud: Opening credit lines, loans, or brokerage accounts
• Account takeover: Social engineering customer service representatives at other financial institutions

The 12 months of Experian credit monitoring offered by OneDigital represents an industry-standard remediation, but SSN exposure creates risks that persist indefinitely.

Attack Vector: The Hidden Cost of SaaS Interconnection

The breach did not result from any compromise of OneDigital's internal systems. Instead, it traced to a vulnerability in the integration between Salesforce, the firm's current CRM platform, and Drift, a chat tool managed by Salesloft, their former CRM provider.

This attack pattern—where legacy integrations create unexpected data exposure—has become increasingly common across financial services. The notification letter suggests that data "stored in Salesforce was potentially accessed and copied by an unauthorized actor due to a compromise of the Drift application."

The technical specifics remain unclear, but the incident points to a common scenario: when firms migrate between SaaS platforms, residual integrations and API connections can persist, creating orphaned attack surfaces that neither the current vendor nor the firm actively monitors.

Similar supply chain dynamics have driven recent breaches across the financial sector. The 700Credit breach demonstrated how web application vulnerabilities at service providers can expose auto lenders' customer data. Likewise, the 1st MidAmerica Credit Union incident showed how a single vendor compromise can cascade across dozens of financial institution clients.

Regulatory Implications for Investment Advisors

GLBA Safeguards Rule Obligations

As a registered investment advisor, OneDigital falls under the Gramm-Leach-Bliley Act's Safeguards Rule (16 CFR Part 314). The FTC's 2023 amendments to the rule require financial institutions to:

• Conduct periodic risk assessments that address risks posed by service providers
• Implement access controls for customer information systems
• Monitor and log activity on systems containing customer information
• Evaluate service providers based on their security practices and contractual protections

The rule explicitly extends accountability to third-party service providers. Section 314.4(d) requires institutions to "oversee service providers" by taking steps to select providers capable of maintaining appropriate safeguards and requiring them by contract to implement such safeguards.

A breach originating from a vendor's vendor (Salesloft managing Drift, which integrated with Salesforce) tests the boundaries of this oversight requirement. Regulators may question whether OneDigital's vendor risk management program adequately addressed fourth-party risk.

SEC Cybersecurity Rules

The SEC's 2023 cybersecurity disclosure rules require registered investment advisers to establish written policies addressing cybersecurity risks, including those arising from service provider relationships. While not imposing specific technical controls, the rules create regulatory expectation for documented vendor oversight.

The eight-month notification timeline may also draw SEC attention. Although the rules primarily address material cybersecurity incidents at public companies, SEC examination staff increasingly scrutinize advisers' incident response timelines during routine examinations.

State Regulatory Exposure

OneDigital operates across multiple states with varying breach notification requirements:

• New York: NY DFS Part 500 requires covered entities to notify the superintendent within 72 hours of determining a cybersecurity event has occurred. Investment advisers with New York operations may face scrutiny over notification timing.
• California: CCPA grants affected residents private right of action for breaches involving unencrypted personal information, potentially exposing OneDigital to statutory damages.
• Texas: Requires notification within 60 days of breach determination.

The firm's notification letter explicitly reserves rights regarding "the applicability of Maine law"—suggesting awareness of potential jurisdictional challenges ahead.

Financial Sector Breach Trends: Third-Party Risk Dominates

The OneDigital incident reflects a broader pattern across financial services. Third-party and supply chain compromises now account for a growing share of breaches affecting banks, credit unions, and investment firms.

Several factors drive this trend:

SaaS proliferation: The average financial institution now relies on hundreds of cloud-based applications, each representing a potential attack surface beyond direct institutional control.

API sprawl: Modern CRM, marketing automation, and client communication platforms interconnect through APIs that may persist after vendor relationships end.

Consolidation lag: When financial firms acquire other practices or migrate between platforms, legacy integrations often remain active longer than security teams realize.

Shared infrastructure: Cloud platforms serving multiple financial institutions create concentration risk—a single vulnerability can expose data across dozens of firms simultaneously.

The Ashton Thomas Private Wealth breach illustrated how email system compromises at advisory firms can expose client records. The OneDigital case extends this pattern to CRM systems, where client data aggregation makes successful attacks particularly damaging.

What This Means for Peer Institutions

Investment advisers, wealth managers, and other financial firms operating similar technology stacks should treat this incident as a warning signal. The Salesforce-Drift-Salesloft chain represents a common architecture—and similar integration patterns likely exist across the industry.

Five Action Items for Financial Institution Security Teams

1. Audit active integrations across all SaaS platforms

Request integration inventories from each major SaaS provider. Identify any connections to tools no longer in active use, and revoke API credentials for deprecated integrations. Pay particular attention to chat widgets, marketing automation tools, and customer communication platforms that may have broad data access.

2. Contractually require notification timelines from vendors

Standard vendor contracts should require notification within 24-48 hours of any suspected security event affecting your data. The gap between Salesforce's August 22 notification and the actual August 12-18 breach window suggests even primary vendors may have detection delays.

3. Implement data minimization in CRM systems

Evaluate whether SSNs and other sensitive identifiers need to reside in CRM platforms at all. Many firms store SSNs in CRM for convenience rather than operational necessity. Moving sensitive data to purpose-built systems with stricter access controls reduces exposure when marketing and communication tools are compromised.

4. Establish fourth-party visibility requirements

Vendor questionnaires should identify subprocessors with access to customer data. Require notification and consent rights when vendors change subprocessor relationships. The Salesloft-Drift relationship that enabled this breach may not have been visible in standard vendor assessments.

5. Pre-position breach response resources

Draft notification templates for various breach scenarios, pre-negotiate credit monitoring contracts, and establish relationships with forensic firms before incidents occur. OneDigital's eight-month timeline suggests the "thorough and time-intensive review" could have moved faster with better advance preparation.

Looking Ahead

The OneDigital breach will likely draw regulatory attention given the notification timeline and the sensitive nature of investment advisory relationships. Affected individuals—many of whom entrusted OneDigital with retirement savings and wealth management—may pursue litigation if identity theft materializes.

For the broader industry, this incident reinforces that perimeter security has limited value when customer data lives across a constellation of SaaS platforms. The breach occurred entirely outside OneDigital's network—yet the firm bears full responsibility for customer notification and remediation.

Financial institutions must extend their security programs to encompass the full ecosystem of platforms touching customer data. Annual vendor questionnaires and SOC 2 reports provide baseline assurance, but they cannot substitute for active monitoring of integration architectures and rapid response capabilities when vendor incidents occur.

The 28,414 individuals now monitoring their credit reports represent the human cost of third-party risk management gaps. Their experience should inform how peer institutions approach vendor oversight in the months ahead.