Davenport & Company Data Breach Lawsuit Investigation
Were you recently notified that Davenport & Company leaked your Social Security number or financial data? The breach is serious and time-sensitive—identity thieves now have everything they need. Find out how to protect yourself and whether you can seek compensation.
Download Official Breach Notice (PDF)
What Happened?
On April 4, 2025, Davenport & Company, LLC filed a notice with the Massachusetts Attorney General confirming that an unauthorized party—using the alias “LEAKEDDATA”—had infiltrated the firm’s systems and exfiltrated sensitive customer information. The same threat actor publicly advertised the stolen database on December 13, 2024.
At least 30 Massachusetts residents—and potentially thousands of clients nationwide—had their personal information exposed.
What Information Was Compromised?
The disclosure indicates that the attacker accessed highly sensitive personally identifiable information (PII), including:
- Full names
- Social Security numbers
- Dates of birth and addresses
- Government-issued IDs (e.g., driver’s license numbers)
- Medical and financial account details
Because Social Security numbers and financial details were involved, those affected face an elevated risk of identity theft, tax fraud, and unauthorized banking transactions.
Davenport & Company’s Response
The company is offering 24 months of complimentary credit monitoring, credit reporting and identity restoration services through Cyberscout, a TransUnion subsidiary. Impacted consumers must enroll within 90 days of receiving their notification letter.
According to Davenport & Company’s notice, the firm has also:
- Engaged third-party cybersecurity experts to investigate and contain the incident.
- Implemented additional security measures to prevent future breaches.
- Notified relevant regulators and law-enforcement agencies.
Steps You Should Take Now
Even if you plan to join a lawsuit, you should act immediately to mitigate potential damage:
- Enroll in the free credit monitoring offered by Davenport via Cyberscout.
- Order your free credit reports at AnnualCreditReport.com and review for unfamiliar accounts.
- Place a fraud alert or credit freeze with Equifax, Experian and TransUnion.
- Report suspicious activity to the FTC through IdentityTheft.gov.
- Document your time and expenses related to the breach—these records can bolster any future compensation claims.
Potential Legal Options
U.S. data-privacy laws allow victims to pursue damages when organizations fail to protect personal information. If Davenport & Company’s security practices are found deficient, affected clients may be entitled to:
- Reimbursement for out-of-pocket losses (credit-monitoring fees, fraudulent charges, etc.)
- Compensation for time spent resolving identity theft issues
- Statutory damages under state data-breach statutes
- Credit-repair services and long-term monitoring
Class action investigations are under way. Preserving evidence—such as your notification letter and any fraudulent statements—will strengthen your case if you choose to participate.
About Davenport & Company
Founded in 1863 and headquartered in Richmond, Virginia, Davenport & Company is one of the nation’s oldest employee-owned investment firms. The company employs more than 400 associates across Virginia, North Carolina, Maryland and Georgia, providing services that range from brokerage to corporate finance.
Frequently Asked Questions
How do I know if I’m included in the Davenport & Company data breach?
You should have received a mailed notification from Davenport & Company. The letter will outline what information was exposed and provide enrollment instructions for free credit monitoring.
Is the credit monitoring from Davenport & Company enough protection?
Credit monitoring detects suspicious activity, but it does not prevent fraudulent accounts from being opened. Placing a credit freeze and monitoring bank statements are still recommended.
Can I join a class action lawsuit against Davenport & Company?
If your personal data was compromised, you may qualify. Keep all documentation—notice letters, credit-monitoring receipts and evidence of fraud—and consult with a data-breach attorney about next steps.
What damages could I recover?
Victims may seek compensation for out-of-pocket expenses, credit-repair costs, time spent addressing the breach, and potentially statutory or punitive damages depending on state law.
Does this breach affect my investment accounts?
Davenport & Company has not reported unauthorized transactions in client investment accounts. Nevertheless, monitor account statements closely and report discrepancies immediately.
Key Takeaways
- Breach disclosed April 4, 2025 after data appeared online in December 2024.
- Sensitive PII—Social Security numbers, financial and medical info—was exposed.
- Free 24-month credit monitoring is available; enrollment deadline is 90 days from your notice.
- Victims may have legal grounds to seek monetary compensation.
This article is for informational purposes only and does not constitute legal advice.