What happened
DriveWealth has advised us that an unauthorised party accessed data held on its systems on 4 and 5 September 2026, including data relating to Hatch customers. Hatch systems were not accessed.
What information was involved
DriveWealth’s assessment so far shows the following data may have been exposed:
Name, address, phone number, and email address
Investor profile information (such as income range and net asset range)
Cash balance and portfolio value
Hatch login and holdings were not affected
Hatch login details are held on Hatch systems, which were not compromised. DriveWealth is confident that no unauthorised transactions were made and investment holdings were not affected by the incident.
What has been done
DriveWealth has investigated the incident with the support of independent cybersecurity experts. It has advised us that it has not identified an ongoing threat to its systems and has strengthened its security controls following the incident.
We are continuing to work closely with DriveWealth as its investigation progresses and are engaging with the relevant authorities.
What Hatch customers should do
Hatch users don’t need to change their password because of this incident. Hatch also requires two-factor authentication for customer accounts.
However, the information involved could be used to make fraudulent emails, text messages or phone calls more convincing. We advise customers take extra care with unexpected contact about Hatch, DriveWealth or their investments.
Please remember:
Never share passwords or two-factor authentication codes. Hatch and DriveWealth will never ask for these by email, text message or phone.
Be cautious about unexpected or urgent requests, particularly those that refer to Hatch, DriveWealth, investments or personal information.
Don’t click links in suspicious messages. If accessing Hatch, open our website directly by typing the address into the browser.
Protect email accounts with a unique password and multi-factor authentication and do the same for other important online accounts.
If customers receive suspicious contact claiming to be from Hatch, or notice anything unexpected in your account, they should contact us at support@hatchinvest.nz or via our online chat.
We’re treating this incident very seriously and will continue working closely with DriveWealth and the relevant authorities. This page will be updated if further information becomes available.
Is my account safe?
Yes, your Hatch account and the assets you are invested in remain secure.
We recommend customers read our Tips to make your account more secure for additional ways to protect your account.
Why did I receive an email regarding the incident when my Hatch account is closed?
US regulations require DriveWealth to retain certain information for a period of time after an account is closed. As a result, although your Hatch account was closed, some of your information will remain on DriveWealth’s systems to satisfy this requirement. We have not reopened your account and are contacting you only as we believe it is important you are informed of this incident.
What can I do to help keep myself and my Hatch account safe?
Take a few minutes to read our Tips to make your account more secure.
You can also visit the New Zealand Government's cyber security website, Own Your Online, for general guidance on staying safe online.
What insurance does Hatch have?
Both your investments and cash held with DriveWealth are protected by SIPC & FDIC insurances.
What are Hatch and DriveWealth doing to keep my account safe?
DriveWealth and Hatch have teams that monitor known malicious websites and platforms for industry-related data. We have also notified New Zealand Police and the National Cyber Security Centre, which monitor and respond to cyber incidents that may affect New Zealanders.
Why does DriveWealth have my personal information?
DriveWealth is the US-regulated broker that Hatch uses to provide access to US markets. To open and maintain an investment account on your behalf, DriveWealth is required to collect and store certain personal information so you can access and trade on exchanges such as the NYSE and NASDAQ.
Have Hatch customer accounts been accessed or compromised?
No Hatch systems were compromised, no account passwords or login credentials were obtained, and DriveWealth has advised that no unauthorised transactions were made.