ShinyHunters Claims Breach of Elite Wealth Firm Pathstone Family Office Cyber extortion group ShinyHunters has alleged a breach of Pathstone Family Office, a wealth management firm serving high-net-worth clients. In a post on its dark web leak site, the group claimed to have exfiltrated 641,000 records, including personally identifiable information (PII) and internal corporate documents. Pathstone was given until March 2 to respond before the data was reportedly set to be released. Pathstone, which manages $170 billion in assets for over 750 families, has not confirmed the breach, and no sample data has been provided to verify the claim. If substantiated, the exposed records could include legal paperwork, estate planning details, financial structures, and client contracts, posing risks of fraud, impersonation, intellectual property theft, and reputational harm. ShinyHunters has recently targeted other financial advisory firms, including Beacon Pointe Advisors and Mercer Advisors, later publishing alleged stolen data. The group has also been linked to past breaches involving Waltio, Salesforce CRM, Crunchbase, and Bumble.

ShinyHunters Extortion Gang Targets Two Major U.S. Investment Advisors The notorious cybercrime group ShinyHunters has claimed responsibility for breaching two high-profile U.S. investment advisory firms Mercer Advisors and Beacon Pointe Advisors threatening to leak millions of sensitive client records unless paid by February 18, 2026. The attackers allege they stole 5 million records from Mercer Advisors and over 100,000 from Beacon Pointe, including personally identifiable information (PII) and internal corporate data. Beacon Pointe Advisors, headquartered in Newport Beach, California, is the largest female-led independent registered investment advisor (RIA) in the U.S., managing $62 billion in assets and employing over 600 people. It ranked #7 on Barron’s Top 100 RIA list in 2025 and received investment from private equity firm Kohlberg Kravis Roberts & Co. in 2021. Mercer Advisors, based in Denver, oversees $92 billion in assets with a workforce of 1,500, topping Barron’s list in 2024 and 2025. The extortion attempt follows a pattern of pressure tactics, with ShinyHunters warning of "annoying (digital) problems" if demands are ignored. The group, linked to multiple high-profile breaches including a 2024 attack on a French cryptocurrency tax platform has a history of targeting enterprise cloud services and customer databases. In June 2025, French authorities arrested four alleged members of the gang, though its operations appear to continue. Mercer Advisors previously disclosed a 2025 data breach tied to its April 30 acquisition of Tufton Capital, affecting 661 individuals after unauthorized access between May 15–16, 2025. It remains unclear whether the current incident is connected to that breach, though cybercriminals often resurface old data. Neither firm has publicly confirmed the breach, and no data samples have been provided to verify ShinyHunters’ claims. If true, the incident could trigger regulatory scrutiny and reputational damage for the firms. ShinyHunters’ ultimatum underscores the persistent threat of extortion-driven cyberattacks in the financial sector.

ShinyHunters Leaks Millions of Records from Top US Investment Firms in Extortion Attack Last week, the notorious cybercriminal group ShinyHunters dumped 5.7 million records tied to two major U.S. investment advisory firms Mercer Advisors and Beacon Pointe Advisors after issuing a 48-hour ultimatum and failing to secure a ransom payment. The leaked data, posted on the dark web, includes client contracts, personal identifiable information (PII), and internal documents, raising concerns over potential identity theft and financial fraud. ### Key Details of the Breach - Victims: Mercer Advisors (Denver-based, managing $92 billion in assets) and Beacon Pointe Advisors (Newport Beach-based, managing $62 billion), both ranked among Barron’s top RIAs. - Attacker: ShinyHunters, a well-known extortion group linked to high-profile breaches, including Canada Goose, Hinge, and Match.com. - Data Exposed: - Mercer Advisors: 5GB of records, including client contracts and PII. - Beacon Pointe Advisors: 60GB of data, though researchers noted some records may be duplicates. - Timeline: The breach occurred between May 15–16, 2025, with the data leak following a failed extortion attempt. ### Previous Incidents & Law Enforcement Action Mercer Advisors had previously disclosed a 2025 breach tied to its acquisition of Tufton Capital, affecting 661 individuals. Meanwhile, French authorities arrested four alleged ShinyHunters members on June 25, 2025, though the group’s operations appear ongoing. ### Impact & Unanswered Questions While the firms have not confirmed the breach, researchers verified the authenticity of the leaked data. The incident underscores the growing threat of extortion-driven attacks on financial institutions, where cybercriminals leverage stolen data to pressure victims into paying ransoms or face public exposure. ShinyHunters’ latest attack reinforces its reputation as a high-impact threat actor, targeting elite firms with vast troves of sensitive client information. The full extent of the breach’s fallout remains unclear as investigations continue.