Financial Firms Face Class Action Lawsuits Over Data Breaches as FINRA Launches Cyber Threat Portal Cetera Financial and Ameriprise are the latest financial services firms embroiled in class action lawsuits over alleged data breaches, with customers accusing both companies of failing to safeguard sensitive client information. In a lawsuit filed by California resident Jennifer Collier, Cetera is accused of negligence after an unauthorized actor accessed an employee’s email account last summer. A subsequent review in January revealed that client data including names, Social Security numbers, and account details may have been exposed. The suit argues that Cetera’s security measures were inadequate, leaving affected clients vulnerable to long-term identity theft and financial fraud. Separately, Ameriprise faces a class action led by Pamela Caffrey, alleging a March 22 breach by the cybercriminal group ShinyHunters. The ransomware attack reportedly compromised Salesforce records containing personally identifiable information (PII) and over 200GB of internal data. Caffrey’s suit claims Ameriprise failed to notify victims, leaving them unaware of the exposure and at continued risk. The firm stated it contained the breach, confirmed no business disruptions, and asserted that the plaintiff’s PII was not impacted. Both incidents follow a string of recent breaches targeting financial firms, including Mercer Advisors, Hightower Advisors, and Edelman Financial Engines. Amid rising cyber threats, the Financial Industry Regulatory Authority (FINRA) has launched the Financial Intelligence Fusion Center, a secure portal for member firms to report and coordinate responses to cyber risks. Designed to provide actionable threat intelligence, the platform aims to bolster defenses, particularly for smaller firms lacking dedicated cybersecurity resources. FINRA CEO Robert Cook previously noted the center would leverage internal and external data to enhance risk mitigation.

ShinyHunters Claims Breach of Elite Wealth Firm Pathstone Family Office Cyber extortion group ShinyHunters has alleged a breach of Pathstone Family Office, a wealth management firm serving high-net-worth clients. In a post on its dark web leak site, the group claimed to have exfiltrated 641,000 records, including personally identifiable information (PII) and internal corporate documents. Pathstone was given until March 2 to respond before the data was reportedly set to be released. Pathstone, which manages $170 billion in assets for over 750 families, has not confirmed the breach, and no sample data has been provided to verify the claim. If substantiated, the exposed records could include legal paperwork, estate planning details, financial structures, and client contracts, posing risks of fraud, impersonation, intellectual property theft, and reputational harm. ShinyHunters has recently targeted other financial advisory firms, including Beacon Pointe Advisors and Mercer Advisors, later publishing alleged stolen data. The group has also been linked to past breaches involving Waltio, Salesforce CRM, Crunchbase, and Bumble.

ShinyHunters Extortion Gang Targets Two Major U.S. Investment Advisors The notorious cybercrime group ShinyHunters has claimed responsibility for breaching two high-profile U.S. investment advisory firms Mercer Advisors and Beacon Pointe Advisors threatening to leak millions of sensitive client records unless paid by February 18, 2026. The attackers allege they stole 5 million records from Mercer Advisors and over 100,000 from Beacon Pointe, including personally identifiable information (PII) and internal corporate data. Beacon Pointe Advisors, headquartered in Newport Beach, California, is the largest female-led independent registered investment advisor (RIA) in the U.S., managing $62 billion in assets and employing over 600 people. It ranked #7 on Barron’s Top 100 RIA list in 2025 and received investment from private equity firm Kohlberg Kravis Roberts & Co. in 2021. Mercer Advisors, based in Denver, oversees $92 billion in assets with a workforce of 1,500, topping Barron’s list in 2024 and 2025. The extortion attempt follows a pattern of pressure tactics, with ShinyHunters warning of "annoying (digital) problems" if demands are ignored. The group, linked to multiple high-profile breaches including a 2024 attack on a French cryptocurrency tax platform has a history of targeting enterprise cloud services and customer databases. In June 2025, French authorities arrested four alleged members of the gang, though its operations appear to continue. Mercer Advisors previously disclosed a 2025 data breach tied to its April 30 acquisition of Tufton Capital, affecting 661 individuals after unauthorized access between May 15–16, 2025. It remains unclear whether the current incident is connected to that breach, though cybercriminals often resurface old data. Neither firm has publicly confirmed the breach, and no data samples have been provided to verify ShinyHunters’ claims. If true, the incident could trigger regulatory scrutiny and reputational damage for the firms. ShinyHunters’ ultimatum underscores the persistent threat of extortion-driven cyberattacks in the financial sector.

Mercer Advisors Data Breach Exposes Sensitive Information of Thousands On January 22, 2026, Mercer Advisors Inc. detected suspicious activity on its network, later confirmed as a data breach. A forensic investigation revealed that cybercriminals had infiltrated the company’s inadequately secured systems, gaining access to files containing sensitive personal data of thousands of individuals. The exposed information includes names, Social Security numbers, financial account details, credit/debit card information, medical records, driver’s license numbers, dates of birth, and addresses. The breach potentially places this data in the hands of threat actors, who may sell it on the dark web or use it for identity theft. Murphy Law Firm has launched an investigation into the incident and is evaluating legal action, including a potential class action lawsuit, on behalf of affected individuals. The firm specializes in data breach litigation and has begun outreach to those impacted. Mercer Advisors has not yet disclosed the full scope of the breach or the number of individuals affected.

ShinyHunters Leaks Millions of Records from Top US Investment Firms in Extortion Attack Last week, the notorious cybercriminal group ShinyHunters dumped 5.7 million records tied to two major U.S. investment advisory firms Mercer Advisors and Beacon Pointe Advisors after issuing a 48-hour ultimatum and failing to secure a ransom payment. The leaked data, posted on the dark web, includes client contracts, personal identifiable information (PII), and internal documents, raising concerns over potential identity theft and financial fraud. ### Key Details of the Breach - Victims: Mercer Advisors (Denver-based, managing $92 billion in assets) and Beacon Pointe Advisors (Newport Beach-based, managing $62 billion), both ranked among Barron’s top RIAs. - Attacker: ShinyHunters, a well-known extortion group linked to high-profile breaches, including Canada Goose, Hinge, and Match.com. - Data Exposed: - Mercer Advisors: 5GB of records, including client contracts and PII. - Beacon Pointe Advisors: 60GB of data, though researchers noted some records may be duplicates. - Timeline: The breach occurred between May 15–16, 2025, with the data leak following a failed extortion attempt. ### Previous Incidents & Law Enforcement Action Mercer Advisors had previously disclosed a 2025 breach tied to its acquisition of Tufton Capital, affecting 661 individuals. Meanwhile, French authorities arrested four alleged ShinyHunters members on June 25, 2025, though the group’s operations appear ongoing. ### Impact & Unanswered Questions While the firms have not confirmed the breach, researchers verified the authenticity of the leaked data. The incident underscores the growing threat of extortion-driven attacks on financial institutions, where cybercriminals leverage stolen data to pressure victims into paying ransoms or face public exposure. ShinyHunters’ latest attack reinforces its reputation as a high-impact threat actor, targeting elite firms with vast troves of sensitive client information. The full extent of the breach’s fallout remains unclear as investigations continue.