Kestra Investment Services, LLC, Kestra Advisory Services, LLC, and Davis Advisory Group operate within the highly regulated financial services, wealth management, and investment advisory sectors. These entities handle substantial wealth portfolios, retirement accounts, and financial planning for clients nationwide, working in tandem with specialized advisory groups like Davis Advisory Group to deliver comprehensive financial strategies. Because of the nature of their business, these institutions maintain vast repositories of sensitive personally identifiable information and financial records. They routinely collect and process comprehensive client dossiers necessary for executing transactions, managing investment portfolios, conducting tax planning, and satisfying strict federal regulatory compliance standards.
In 2025, the companies reported a significant security incident to the New Hampshire Attorney General, alerting clients and regulatory bodies to a compromise of their digital environment. In the financial services industry, incidents of this magnitude typically involve sophisticated cyberattacks, such as unauthorized intrusions into centralized client databases, credential stuffing attacks targeting advisory portals, or third-party vendor compromises that expose interconnected financial networks. Financial institutions remain prime targets for malicious actors seeking high-value financial data, proprietary advisory notes, and deep consumer profiles that can be weaponized for rapid economic exploitation.
Preliminary indications suggest that the breach compromised a diverse array of sensitive consumer and investor data, creating severe risks of long-term financial and personal harm. Exposed information frequently includes full names, Social Security numbers, dates of birth, financial account numbers, investment portfolio valuations, banking routing numbers, and tax-related documentation. The unauthorized disclosure of this data creates immediate dangers of financial account takeover, unauthorized wire transfers, fraudulent loan applications, and complex identity theft. Victims face a heightened, persistent risk of targeted phishing attacks where bad actors leverage stolen financial context to impersonate advisors or institutions, draining client accounts and devastating retirement savings.
As financial institutions, Kestra Investment Services, LLC, Kestra Advisory Services, LLC, and Davis Advisory Group are bound by rigorous federal and state statutory frameworks, most notably the Gramm-Leach-Bliley Act (GLBA) and the safeguards rules promulgated by the Securities and Exchange Commission. These regulations mandate the implementation of robust administrative, technical, and physical safeguards to protect non-public personal information from unauthorized access, disclosure, or misuse. The occurrence of a widespread data breach strongly indicates potential failures in maintaining adequate cybersecurity infrastructure, employee training, or third-party risk management, exposing the companies to significant legal liability for failing to uphold their statutory duties of data protection.
Receiving a formal data breach notification letter from Kestra Investment Services, LLC, Kestra Advisory Services, LLC, and Davis Advisory Group serves as official legal acknowledgment that your confidential financial and personal records were compromised due to corporate negligence. Under modern data privacy jurisprudence, the receipt of such a notification generally confers legal standing to participate in a class action lawsuit seeking accountability, enhanced credit monitoring, and financial compensation. Importantly, affected individuals are not required to demonstrate immediate out-of-pocket financial loss to join an action, as the increased risk of future identity theft and the loss of privacy constitute actionable harm. Our firm is actively investigating this breach on a contingency fee basis, meaning there are never any out-of-pocket costs or attorney fees unless we successfully recover compensation on your behalf.