Johnson Investment Counsel Hit by Data Breach, Exposing Sensitive Client Information Johnson Investment Counsel, an independent wealth management firm based in Cincinnati, Ohio, confirmed a data breach after unauthorized access to its network was detected on September 9, 2026. The intrusion occurred via a third-party managed service provider’s remote-management platform, with the attacker accessing systems between the evening of September 8 and the early morning of September 9. The hacking group Storm claimed responsibility, alleging they exfiltrated 39.6 GB of data and threatened to publish it on the dark web. The breach was publicly disclosed on the Tor network on September 18, 2026. Exposed data included names, Social Security numbers, health insurance information, and files stored on work personal drives. The firm engaged cybersecurity professionals to investigate and contain the incident, notified law enforcement, and sent written notices to affected individuals. The breach was also reported to the Massachusetts Attorney General on October 8, 2026. Johnson Investment Counsel, founded in 1965, serves individuals, families, retirement plans, foundations, endowments, and corporations with fee-only financial services. The firm is now under investigation by Shamis & Gentile P.A., a class-action law firm specializing in data breach cases, regarding potential compensation for impacted clients.

The DragonForce ransomware operation successfully breached a managed service provider and used its SimpleHelp remote monitoring and management (RMM) platform to steal data and deploy encryptors on downstream customers' systems. The threat actors exploited a chain of older SimpleHelp vulnerabilities tracked as CVE-2024-57727, CVE-2024-57728, and CVE-2024-57726 to breach the system. The attackers first performed reconnaissance on customer systems, collecting information about the MSP’s customers, device names, configurations, users, and network connections. They then attempted to steal data and deploy decryptors on customer networks, which were blocked on one network using Sophos endpoint protection. However, other customers were not so lucky, with devices encrypted and data stolen for double-extortion attacks. The breach has led to significant data theft and encryption of customer systems.