OneDigital Data Breach: 28,414 Individuals Affected

OneDigital Investment Advisors LLC, an SEC-registered investment adviser based in Overland Park, Kansas, disclosed a data breach involving third-party platform providers Salesforce and Drift that affected 28,414 people in the United States, including 73 Maine residents.

The company reported a breach discovery date of Dec. 22, 2025, and is scheduled to begin notifying affected consumers in writing on April 8, 2026.

What happened in the OneDigital data breach

On Aug. 22, 2025, Salesforce, OneDigital's customer relationship management platform provider, notified the company of a possible data security event. The event involved both the Salesforce platform and Drift, and did not involve any compromise of OneDigital's own internal network or systems.

OneDigital launched a forensic investigation with the assistance of cybersecurity specialists to determine the nature and scope of the incident. The investigation found that between Aug. 12 and Aug. 18, 2025, an unauthorized actor potentially accessed and copied certain OneDigital data stored within the Salesforce platform.

Following the initial investigation, OneDigital conducted a review of the potentially affected data to identify what sensitive customer information was involved and to determine which individuals needed to be notified.

The personal information exposed in the breach included names and Social Security numbers.

OneDigital's response to the breach

OneDigital is offering affected individuals 12 months of complimentary credit monitoring and identity monitoring services through Experian IdentityWorks. The membership includes daily credit reports for online members, active credit monitoring of Experian files, identity restoration support and $1 million in identity theft insurance.

Individuals who wish to enroll must do so by June 30, 2026.

The identity restoration feature does not require enrollment to activate. Experian identity restoration agents can help affected individuals investigate and resolve incidents of fraud, including contacting credit grantors to dispute charges, placing freezes on credit files and working with government agencies.

For questions or assistance, affected individuals can call OneDigital's dedicated assistance line at 833-549-2144, available Monday through Friday from 8 a.m. to 8 p.m. Central Time, excluding major U.S. holidays.

Individuals can also reach the company by email at incident@onedigital.com or by mail at 300 Galleria Parkway, Suite 1100, Atlanta, GA 30339, ATTN: Privacy Officer.

Steps to take if your information was exposed

• Place a fraud alert or credit freeze with Equifax at 1-888-298-0045, Experian at 1-888-397-3742 or TransUnion at 1-833-799-5355 to help prevent unauthorized accounts from being opened.
• Request free credit reports at AnnualCreditReport.com and review them for unfamiliar accounts or inquiries; the Consumer Financial Protection Bureau also provides a summary of consumer rights under federal law.
• Monitor bank and credit card statements over the next 12 to 24 months for any unauthorized transactions or suspicious activity.
• Be cautious of phishing attempts that reference OneDigital or this data breach by name, as scammers may use the incident to trick people into sharing more personal information.
• Report suspected identity theft to the Federal Trade Commission at 1-877-438-4338 or file a complaint at usa.gov/identity-theft.
• Contact your state attorney general to report fraud or learn about additional protections.