Directed Trust Company, operating under the brand Directed IRA, disclosed a data breach after unauthorized activity occurred between July 4 and July 16, 2026. The Arizona-regulated financial trust company submitted official notifications to state attorneys general, including filings in Vermont on October 27, 2026, and Texas on October 28, 2026. The firm sent written breach notification letters to affected individuals by U.S. mail.
The incident compromised sensitive personal and financial records. Exposed data elements include individual names, addresses, Social Security numbers, driver's license numbers, government identification details, financial account codes, and credit or debit card numbers. Regulatory data compilations report that up to 9,586 individuals nationwide were affected, including 1,346 residents in Texas and nine in Vermont. No clinical medical data was reported compromised.
Law firms announced investigations following the regulatory disclosures. As state investigations proceed and additional state breach logs update, class size counts and technical scope details may adjust.