Directed Trust Data Breach Notice (California Attorney General)

The breach notice from Directed Trust means that personal information belonging to some of its customers is now outside the company’s control. Because the filing reached the California Attorney General on October 27, 2026 for an incident dated July 04, 2026, 115 days passed between the two events. That interval is the single most concrete fact the record contains.

Personal information that cannot be replaced

The filing lists only “personal information” as exposed. No passwords, no financial account numbers, and no government identifiers such as Social Security numbers appear in the disclosed categories. This is genuinely good news: nothing on the exposed list is permanent in the way a Social Security number or passport is. The data that was taken can, in most cases, be corrected or monitored.

What the 115-day gap changes for you

Directed Trust has not disclosed when it first learned of the incident, only the incident date and the filing date. The gap of roughly three months and three weeks is long enough to matter. During that period the company investigated, contained the event, and prepared notifications. Customers whose records were included should assume the information has been available to unauthorized parties for some time.

The record does not state how many people were affected. It also does not name the root cause, whether data was exfiltrated, or the exact subtypes of personal information involved beyond the broad category listed.

How to know if this notice concerns you

Directed Trust is required to notify affected customers directly, usually by mail to the address it has on file. If you have not received a letter, your information was most likely not included. Anyone who has moved since July 04, 2026 should contact the company directly to confirm whether their records were part of this incident.

What this exposure enables

Personal information alone can still be used to attempt identity theft, phishing, or social-engineering attacks that appear to come from Directed Trust. Because the company holds trust and estate accounts for many customers, attackers may try to combine this data with publicly available information to craft convincing requests for account changes or wire transfers.

The absence of passwords in the exposed categories means you do not need to change your Directed Trust login credentials because of this incident. The account itself remains secure provided your password was strong and unique.

Concrete steps that address this specific exposure

• Watch for unexpected mail or calls claiming to be from Directed Trust. Verify any request for money movement or personal details by contacting the company using a phone number you already know is correct.
• Place a fraud alert with the three major credit bureaus. A fraud alert forces lenders to verify your identity before opening new accounts and lasts for one year.
• Review your Directed Trust statements and online account activity every week for the next several months. Look for any transactions or address changes you did not authorize.
• Update your contact information with Directed Trust if you have moved since July 2026. This ensures future notices reach you and reduces the chance that important account mail is misdirected.
• Consider credit monitoring or identity theft protection services that alert you to new inquiries or accounts opened in your name. These services cannot prevent misuse but can shorten the time between theft and discovery.