Windhaven Investment Management recently began notifying an undisclosed number of clients that their account information may have been viewed by an unauthorized person or persons.
“Windhaven recently discovered evidence of an unauthorized intrusion on a Web server maintained by a third-party vendor that we hired,” the company stated in the notification letter [PDF]. “The intruder may have been able to use this Web server to access a database that contained your name, account number, custodian, and investment posititions for your Windhaven account(s) only.”
The breach was discovered in August 2013, though any access to account information may have occurred months earlier.
The affected Web server and database have been permanently disabled, and the incident is being reviewed. All those affected are being offered one free year of credit monitoring from Equifax.