Stake

Stake's customers were exposed not through Stake's systems but through DriveWealth, the US vendor running its trading and wallet services, after a social-engineering campaign DriveWealth says it has since contained. Names, emails, phone numbers, postal addresses, tax status, and tax country moved; trading accounts, portfolios, tax file numbers, and bank details reportedly did not. Stake outsourced the plumbing of its US operation and inherited DriveWealth's exposure along with it. Nobody says who was talked into what; the notice just confirms that someone was.