DBR & CO Data Breach Exposes Social Security Numbers

D.B. Root & Co. LLC, a Pittsburgh-based investment advisory firm doing business as DBR & CO, disclosed a data breach that affected 2,806 individuals in the United States.

An unauthorized individual gained access to DBR & CO's network between Nov. 11 and Nov. 12, 2025, according to the company's notification to affected consumers. The firm stated that it first learned of the possible unauthorized access on or about Nov. 11, 2025.

After an extensive investigation, the company determined on April 9, 2026, that a limited amount of personal information may have been subject to unauthorized acquisition during that two-day period, according to the notice. The determination came nearly five months after the company first detected the unauthorized access on its network.

The types of personal information potentially exposed included full names, Social Security numbers and financial account information.

The breach was disclosed to attorneys general in Maine and Vermont on June 2, 2026, and to the Massachusetts Office of Consumer Affairs and Business Regulation on June 4, 2026. According to state filings, the breach affected one Maine resident, 22 Massachusetts residents and two Vermont residents, along with two Rhode Island residents.

The company reported discovering the breach on May 13, 2026, and began notifying consumers in writing on May 27, 2026.

DBR & CO's response

DBR & CO has arranged for affected individuals to receive complimentary identity monitoring services through Kroll. The services include single bureau credit monitoring, which alerts individuals when changes are detected in their credit files.

Affected individuals also receive unlimited access to fraud consultation with a Kroll specialist. This service includes guidance on protecting against identity theft, an explanation of legal rights and protections, and help with placing fraud alerts, according to the notice.

The company is also providing identity theft restoration services through Kroll. If someone becomes a victim of identity theft, a licensed Kroll investigator will work on their behalf to uncover the scope of the theft and help resolve related issues, according to the notification. Enrolling in the identity monitoring program will not affect credit scores, the company stated.

Affected individuals can enroll in the complimentary monitoring services by visiting the Kroll enrollment website and entering the membership number included in their written notification. Each letter includes an activation deadline, after which the enrollment code will no longer work.

The company has established a dedicated toll-free response line at 844-576-3122, available Monday through Friday from 8:00 a.m. to 5:30 p.m. Central Time, excluding major U.S. holidays.