D.B. Root & Company Data Breach Exposes Sensitive Financial Information of 2,806 Individuals
D.B. Root & Company, LLC (now operating as DBR & CO), a Pittsburgh-based SEC-registered investment advisory firm, disclosed a data breach that compromised the personal and financial information of 2,806 individuals across multiple U.S. states. The firm, which provides wealth management and financial planning services, detected unauthorized network access on November 11, 2025, and immediately secured its systems while launching an investigation with external cybersecurity experts.
A forensic review concluded on April 9, 2026, revealing that sensitive data including full names, Social Security numbers, and financial account numbers was accessed without authorization between November 11 and 12, 2025. Affected individuals, primarily residents of Maine, Massachusetts, Rhode Island, and Vermont, began receiving written notifications on May 27, 2026.
The breach has prompted legal action, with class action law firm Shamis & Gentile P.A. investigating potential claims for compensation on behalf of impacted individuals. The incident underscores the risks to financial service providers handling sensitive client data.
Source: https://www.claimdepot.com/investigations/db-root-company-data-breach-2026
DBR & CO cybersecurity rating report: https://www.rankiteo.com/company/d-b-root-company
"id": "D-B1780640869",
"linkid": "d-b-root-company",
"type": "Breach",
"date": "11/2025",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'customers_affected': '2806',
'industry': 'Financial Services',
'location': 'Pittsburgh, Pennsylvania, USA',
'name': 'D.B. Root & Company, LLC (DBR & CO)',
'type': 'Investment Advisory Firm'}],
'attack_vector': 'Unauthorized Network Access',
'customer_advisories': 'Written notifications sent to affected individuals on '
'May 27, 2026',
'data_breach': {'number_of_records_exposed': '2806',
'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['Full names',
'Social Security numbers',
'Financial account numbers']},
'date_detected': '2025-11-11',
'date_publicly_disclosed': '2026-05-27',
'description': 'D.B. Root & Company, LLC (now operating as DBR & CO), a '
'Pittsburgh-based SEC-registered investment advisory firm, '
'disclosed a data breach that compromised the personal and '
'financial information of 2,806 individuals across multiple '
'U.S. states. The firm detected unauthorized network access on '
'November 11, 2025, and immediately secured its systems while '
'launching an investigation with external cybersecurity '
'experts. A forensic review revealed that sensitive data was '
'accessed without authorization, prompting legal action and '
'notifications to affected individuals.',
'impact': {'data_compromised': 'Personal and financial information of 2,806 '
'individuals',
'identity_theft_risk': 'High',
'legal_liabilities': 'Potential class action lawsuits',
'payment_information_risk': 'High'},
'investigation_status': 'Concluded',
'references': [{'source': 'Incident disclosure'}],
'regulatory_compliance': {'legal_actions': 'Class action investigation by '
'Shamis & Gentile P.A.'},
'response': {'communication_strategy': 'Written notifications to affected '
'individuals',
'containment_measures': 'Systems secured immediately',
'incident_response_plan_activated': 'Yes',
'third_party_assistance': 'External cybersecurity experts'},
'title': 'D.B. Root & Company Data Breach Exposes Sensitive Financial '
'Information of 2,806 Individuals',
'type': 'Data Breach'}