Direct IRA Data Breach Investigation
A state regulatory listing reports that personal and financial information may have been involved in an incident associated with Directed Trust Company, doing business as Direct IRA. The reported information includes names, addresses, Social Security numbers, driver’s license numbers, and financial account numbers. Strauss Borrelli PLLC is investigating the Direct IRA data incident and its potential impact on affected individuals. If you received a notice or believe your information was involved, fill out the secure contact form on this page to help verify potential claim eligibility.
Directed Trust Company, doing business as Direct IRA, is identified in the supplied regulatory data as an Arizona financial services entity.
Key Facts at a Glance
- Entity Involved: Directed Trust Company dba Direct IRA (Financial Services)
- Incident Type: Not specified in the available regulatory data
- Date of Incident: July 4, 2026 to July 16, 2026, as reported in the supplied filing data
- Discovery Date: Not reported
- Official Notice Date: Not available in the supplied records
- Exposed Information: Names, addresses, Social Security numbers, driver’s license numbers, and financial account numbers
- Affected Population: 9,586 people reported; the scope may change as regulatory records are updated
- Regulatory Listing Date: October 28, 2026
What Happened?
According to data supplied from state Attorney General records, Directed Trust Company dba Direct IRA reported an incident period running from July 4 through July 16, 2026. The matter was listed on the Texas Attorney General’s data security breach portal on October 28, 2026, and the input data also references a Vermont filing. The available record does not identify how access occurred, when the company discovered the issue, whether a third party was involved, or the date individual notices were sent. It therefore would be premature to characterize the event as ransomware, a vendor compromise, or another specific attack. The Texas portal also cautions that reported details, including affected counts and whether notice was provided, may change after publication. People who receive a company notice should compare it with the public filing and retain it for their records.
What Information Was Exposed?
The supplied regulatory data indicates that the information involved may have included names, addresses, Social Security numbers, driver’s license numbers, and financial account numbers. The record does not establish that every affected person had every listed data element involved. In a financial-services incident, this combination of information may increase the risk of identity theft, loan fraud, account-verification scams, unauthorized password-reset attempts, and fraudulent wire-transfer requests. Criminals may also use accurate personal details to make phishing calls, emails, or text messages appear legitimate. Consumers should treat unexpected communications about retirement accounts, transfers, or identity verification with caution.
What Should You Do Next?
- Review the notice and your accounts: Keep any letter or email that appears to come from Direct IRA. Examine bank, retirement, and other financial account statements for unfamiliar transfers, withdrawals, new payees, or changes to contact information.
- Check and protect your credit: Obtain credit reports from the federally authorized AnnualCreditReport.com website. Consider placing free credit freezes with Equifax, Experian, and TransUnion, particularly if your Social Security number may have been involved.
- Secure financial logins: Change reused or weak passwords, enable multifactor authentication, and review account recovery settings. Contact the financial institution through a verified telephone number rather than responding to an unexpected password-reset message.
- Watch for targeted scams: Be cautious of account-verification texts, loan offers, wire-transfer instructions, or callers requesting one-time security codes. Do not provide sensitive information through links in unsolicited messages.
- Preserve records and assess your options: Save notices, suspicious messages, credit reports, and documentation of losses or time spent responding. You may also complete the secure contact form on this page to help determine whether you may qualify to pursue a claim.
Your Legal Rights
People whose information may have been involved can ask for clear information about the incident, the data associated with them, and any protective services being offered. Consumers generally may obtain credit reports, place credit freezes without charge, and dispute fraudulent accounts or transactions. Depending on applicable state law and the facts, affected individuals may also have rights related to notice, data-security practices, reimbursement of documented losses, or other relief. Whether a viable claim exists can depend on residency, the information involved, actual misuse, and the adequacy of the response. Keep relevant records and consider speaking with a qualified attorney. This information is general and is not individualized legal advice.
Why Hire Strauss Borrelli PLLC?
The firm investigates privacy and cybersecurity incidents on behalf of consumers and evaluates whether affected individuals may have legal claims. Its attorneys can review regulatory disclosures, assess the sensitivity of the information involved, and explain potential options in plain language. A confidential case evaluation can also help individuals understand which records to preserve and whether documented fraud, identity-theft concerns, or response costs may be relevant. No outcome is guaranteed, and any evaluation depends on the facts and applicable law.
If you received a breach notification letter from Direct IRA:
We would like to speak with you about your rights and potential legal remedies in response to this data breach. Please fill out the form, below, or contact us at 872.263.1100 or sam@straussborrelli.com.
