Stake (Sydney-founded trading platform) says some Australian customers' personal details were taken in a 4–5 September breach at its US custodian DriveWealth: names, contact details, US tax status, account numbers and balance snapshots; no trading, transfers or withdrawals
Stake, the Sydney-founded investing platform, told customers on 21 September 2026 that DriveWealth, the US broker that provides execution, custody and clearing for Stake Wall St accounts, had a cyber incident that affected some Stake customers' personal information. DriveWealth's own breach notice says unauthorised access to its network took place on 4 and 5 September 2026, was contained on 5 September, and that its document review finished on 28 September. Stake says the information involved varies by person and may include name, email address, phone number and postal address; W-8 or W-9 tax status and country of taxation; the DriveWealth (Stake Wall St) account number; and aggregate snapshots of portfolio value, cash balance and buying power. It says Stake login credentials, tax file numbers and other government ID numbers, bank account details, identity documents, individual holdings and trading history were not accessed, that Stake's own systems were not affected, and that DriveWealth reported no unauthorised trading, transfers or withdrawals. People who opened a Stake Wall St account but no longer use it may also be affected. Stake is emailing affected customers. New Zealand's Hatch and the UK's Freetrade (for former Stake UK customers) have issued similar notices about the same DriveWealth incident. Stake has not said how many Australians are affected. Primary: Stake (21 Sep 2026); vendor: DriveWealth breach notice.
- Exploited in Australia?
- unknown
- Patch to
- Stake customers: check for Stake's email about which details apply to you, treat calls, texts and emails that quote your account number or balances as possible phishing, and log in only through the Stake app or website. No password reset is required by Stake, but turn on two-factor authentication if it is not already on.
Primary: Stake — DriveWealth Data Security Incident (21 Sep 2026) · Vendor: DriveWealth — Notice of Data Breach (California Attorney General filing) · Nine.com.au — Australian trading platform Stake caught in data breach (25 Sep 2026)