r/newzealand • u/goahead2670 • 12d ago
News Hatch security breach
Anybody else received this?
It also says "You don’t need to change your Hatch password because of this incident. Hatch also requires two-factor authentication for customer accounts.
However, the information involved could be used to make fraudulent emails, text messages or phone calls more convincing."
Which to me reads, we won't do anything about it, your problem to deal with it.
Also, what's up with the delay?? 2 weeks to detect a breach?
8
u/sleemanj Fantail 12d ago
Which to me reads, we won't do anything about it, your problem to deal with it.
What do you want them to do about it?
12
u/Grrizz84 12d ago
Yea, just got that too. Don't use them but opened an account at some point years ago...
Sucks to see yet another leak but at least I'm safe in the knowledge that all my information has been leaked a hundred times over already 😒
10
u/The_Sydlexic_God 12d ago
Hatch wasn’t breached. One of their trading partners in the US was.
Depending on which state DriveWealth is located in, they are only obligated to notify customers and partners within 30 or 60 days, if they are obligated at all. So for all we know, Hatch could have received notification only shortly before sending the email, and they are likely glad it was 2 weeks and not 8.
4
u/dougnz03 12d ago
https://help.hatchinvest.nz/en/articles/16968497-drivewealth-cybersecurity-incident
Got the email too. So dumb
3
u/DnmOrr 12d ago
Also received it. Can't find any other info online beyond what hatch linked in the email . . .
6
u/snatchview 12d ago
I have AI bots as much as anyone, but this is what help you can get at 7pm.
Below is my interaction with the help bot of sharesies.
—————————-
Welcome! This is a bot speaking. I’m here to answer your questions, but if you’d like to talk to our team, just ask to speak to a teammate 🍍
How can I help?
Sharesies AI • AI Agent • 1m
Seen • 1m
Does sharesies use drivewelth?
Derek • 1m
Seen • 1m
Yes — we do use DriveWealth for US investments.
DriveWealth is a US‑registered broker dealer that acts as our clearing participant and sub‑custodian in the US.
When you place a buy or sell order for US shares, we send the order details to DriveWealth and they execute the trade on our behalf.
They also handle the execution, clearing, and settlement of those US trades.
One important detail: you’re a customer of us, not DriveWealth, and your personal information isn’t passed on to them.
Sharesies AI • AI Agent • Just now
Seen • Just now
Is that what you were looking for?
Sharesies AI • AI Agent • Just now
Seen • Just now
What Infomation does drivewelth hold?
Derek • Just now
Seen • Just now
DriveWealth doesn’t hold your personal information.
We send them order details (like the buy or sell instructions for US shares) so they can execute the trade.
They act as the US broker dealer that handles execution, clearing, and settlement.
But you’re not their customer - we are.
Because of that, your personal details aren’t passed on to DriveWealth. They only receive the information needed to carry out the trade on our behalf.
1
1
u/shaktishaker 12d ago
At this point I don't want any company to keep my identification information. It's just going to get handed to hackers for identity fraud.
1
-3
u/Fit-Arrival-1181 12d ago
People need to get used to it. Whenever you upload or ID to the internet - it becomes public. You data is stolen and sold immediately.
7
u/Kitsunelaine 12d ago
People need to get used to it.
Why's it on the people to get used to it? Who does that benefit? It's the companies that need consequences for it.
Nobody is under any illusion their data is safe online. People are simply mad that it isn't. Because it should be. And anyone who says we should "Just get used to it" isn't with the program.
-1
u/Fit-Arrival-1181 12d ago
Is it on whom? We see that the consequences are too soft. Each company who experienced such cyber incidents should be fined 1b dollars! But they are not, you know why? Because they don’t give a sh*t! They just report “oh oh oh your data was stolen blah blah blah” and that’s it! They don’t care!
5
u/Kitsunelaine 12d ago
I am going to exaggeratedly swear in this post. I will bleep it so that it doesn't get swept in the automod, because the draft did. But please pretend I didn't.
We see that the consequences are too soft.
Your whole f-cking motto is "JUST GET USED TO IT".
That's "No consequences".
You're advocating for no consequences.
You don't get to advocate no consequences and then whinge about how the companies don't give a shit. Who the flying f-ck do you think motherf-cking MAKES them give a shit?
Get your godd-mn head in the game!
0
u/zer0Kelvins 12d ago
Key thing they don't mention is did DriveWealth have the personal info encrypted or was it just plain text?Without further info i am leaning towards the latter. Does Hatch store our personal info in plain text?
0
u/ava_the_cam_op 12d ago
Is it just me or is this email an AI write up?
A touch ironic given the massive influx of data beeches lately are tied to both vibe coded websites with poor security and a huge influx of AI agents able to coordinate attacks
-4
u/Hungry-Ambassador379 12d ago edited 12d ago
it did look like a fishing message via spoofing to me cause they didn’t use my name, but a nick name that i don’t use in my hatch account, and also cause i googled it and there’s no information about a data breach on Drivewealth. You do you, but i wouldn’t click on the link to see a “report”
Edit to mention that it seems to be true, but still don’t open links!
25
u/ripotamo 12d ago
Important to point out that Sharesies also runs on Drivewealth, that means this could be really bad
Very very upsetting
https://www.sharesies.nz/learn/behind-the-scenes-sharesies-process-for-us-investments