At a glance
- The group said it took five million records from Denver-based Mercer and more than 100,000 from Newport Beach, California-based Beacon Pointe, and threatened to publish them on the dark web unless the firms contacted it and paid.
- In a message cited by Cybernews, the attackers wrote: "This is a final warning to reach out by February 18, 2026 before we leak," and warned the firms not to "be the next headline."
- Mercer confirmed an issue involving unauthorized access to some of its systems used to store client data.
A group calling itself ShinyHunters claimed in February to have stolen client records from Mercer Advisors and Beacon Pointe Advisors, according to a February 26 Financial Advisor Magazine report. The group said it took five million records from Denver-based Mercer and more than 100,000 from Newport Beach, California-based Beacon Pointe, and threatened to publish them on the dark web unless the firms contacted it and paid. Financial Advisor Magazine cited a February 17 Cybernews article and described both firms as among the nation's largest registered investment advisors.
In a message cited by Cybernews, the attackers wrote: "This is a final warning to reach out by February 18, 2026 before we leak," and warned the firms not to "be the next headline."
Mercer confirmed an issue involving unauthorized access to some of its systems used to store client data. A spokesperson said the firm was investigating with outside cybersecurity experts and had notified law enforcement. "Our investigation, along with that of third-party experts, has indicated that this incident is contained," the spokesperson said.
Beacon Pointe reported a data breach affecting three Massachusetts residents to the Massachusetts Office of Consumer Affairs and Business Regulation on February 20, two days past the attackers' stated deadline, according to the state office.
Beacon Pointe indicated the breached data included Social Security numbers, driver's license numbers and financial account numbers; a source familiar with the situation told Financial Advisor Magazine that custodian account information was not included.
Attorneys working with ClassAction.org said they are investigating whether a class action can be filed and are seeking individuals whose data may have been compromised. The ClassAction.org posting says Beacon Pointe "is informing clients of a data breach involving unauthorized access to its IT network," discovered on February 1, 2026, and that the incident "took place from January 30 to February 1." Financial Advisor Magazine reported that Beacon Pointe did not return its request for comment. The February 26 report does not say whether any claimed data was published.
Reported by the Practice management desk from Financial Advisor Magazine. Published . Corrections