The company that lost it was not the one you chose

DriveWealth, an American brokerage, told customers this week that an intruder had copied historical account records from its network on 4 and 5 September. Most British people affected have never opened its website. They used Revolut.

Who is in it

DriveWealth carried out US share trades for other people's apps, Revolut among them. If you bought US shares through Revolut under its earlier arrangement, your details sat with DriveWealth rather than with Revolut. Revolut moved customers in the UK, the EEA and Australia off that arrangement between December 2023 and June 2025, the date varying by market, and stopped sending details onward after each migration.

So this exposure is historical by design. It is the record of a relationship that has already ended, and DriveWealth says it was required to keep those records to meet its regulatory obligations. That is the part worth sitting with: closing an account does not empty the filing cabinet, and in a regulated industry it is not meant to.

What was taken

From the notice sent to affected customers: names, email addresses, phone numbers, postal addresses, employment information, country of citizenship, age, gender, and part of a DriveWealth account number. No passwords. No card or bank details. No identity documents.

• The addresses, employers and ages are the permanent ones. An address cannot be reset, and that particular combination — where you live, who you work for, roughly how old you are — is what a people-search listing is assembled from.
• Country of citizenship and part of an account number are what make an impersonation land. Someone who already knows your address, your employer and the tail of a brokerage account does not sound like a stranger on the phone.
• Nothing here lets anyone sign in or move money. DriveWealth says no trades, transfers or withdrawals were made and that outside investigators found no continuing access. There is no password involved, so we are not going to tell you to change one.

Stake and Hatch customers had more taken than Revolut customers did: tax status and country of taxation for Stake, income and net-asset ranges for Hatch, and for both a snapshot of portfolio value and cash. If you hold one of those accounts, the notice you were sent is not the same notice.

Everything added this week

Below is what the record gained in the seven days to 25 September, including the entries we log from a company's own notice before Have I Been Pwned holds the data. Where a figure is shown it counts account records rather than people: one person with three accounts at the same service appears three times. Treat it as the size of the pile, not the size of the crowd.

• DriveWealthdrivewealth.com · total not disclosed · added 2026-09-24

  Exposed email addresses, names, phone numbers, home addresses and employers.

• LimeLeadslimeleads.com · 18 million accounts · added 2026-09-22

  Exposed email addresses, employers, locations, job titles and phone numbers.

• Burger King Russiaburgerkingrus.ru · 3.2 million accounts · added 2026-09-21

  Exposed dates of birth, email addresses, genders, locations and names.

The rest of the week

LimeLeads was a San Francisco firm, now defunct, that rented out access to a database of business contacts — names, job titles, employers, work numbers. Nobody in it signed up for it; it was compiled about people, from their working lives. It spilled in 2019 because a server was left on the internet with no password on it, and it reached the public record this week, seven years later. The geography in it is American, down to the state and the ZIP code, so a British reader is unlikely to be in this one.

The Burger King Russia entry was not an attack on Burger King Russia. It was an attack on Mindbox, the marketing platform it used, and the data ran from 2018 to August 2024 with dates of birth in it. Russian customers, so again, almost certainly not you.

In every case this week the company that lost the data is not the company the reader dealt with: a clearing broker behind an app, a marketing platform behind a brand, and a firm that never met the people it held records on. That is not a coincidence about this particular week. It is what the arrangement looks like from the inside, and it is why a list of the companies you have accounts with is not a list of the companies holding your details.

What to do about a leaked address

• Treat contact about your investments as unverified for a while, however much the caller appears to know already. End the call and dial the number in the app instead.
• A leaked address does not need resetting. It needs removing from the places that resell it, which is a different job from changing a password, takes longer, and nobody emails you a prompt to start it.
• If you want the organisation to answer for it, the ICO accepts complaints about how a company handled your personal information — including when the company that lost it was its supplier rather than the company you signed up with.

We publish every holder we act against by name, so the claim can be checked rather than taken on trust. Start with the coverage list and see which of them carries a home address.