Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →In February 2026, the cyber-extortion group ShinyHunters claimed attacks on several large U.S. wealth-management firms, including Mercer Advisors, Pathstone Family Office and Beacon Pointe Advisors. The public evidence describes a data-theft and extortion campaign—not proof that criminals transferred money from clients’ brokerage accounts.
The important distinction is between an attacker’s claim, a company confirmation, a lawsuit allegation and a forensically verified breach. Those are not interchangeable, and the scope remains unsettled for some firms.
Which investment advisers were named?
| Firm | What has been publicly reported | What remains uncertain |
|---|---|---|
| Mercer Advisors | Two putative class-action complaints reported in March 2026 alleged that about 5.7 million internal records were exposed and that ShinyHunters later published data after Mercer allegedly declined to pay. The complaints reportedly described names, contact details, full or partial Social Security numbers, emergency contacts, legal documents and other personal information. InvestmentNews also described Mercer as managing more than $96 billion. | The 5.7 million figure, the complete data inventory, authenticity of leaked material and any ultimate legal findings have not been independently established in the cited reporting. |
| Pathstone Family Office | ShinyHunters was reported to have claimed approximately 641,000 records containing personally identifiable information and internal corporate documents. Pathstone was described as managing roughly $170 billion through at least 22 offices. ClassAction.org reported a March 2, 2026 ransom deadline. | The available reporting does not independently validate that every claimed record was genuine, current, complete or obtained from Pathstone. |
| Beacon Pointe Advisors | Public reporting connected Beacon Pointe to the same series of claims. The company said fewer than 0.5% of its clients were affected, that those clients had been notified and that protective measures had been deployed. InvestmentNews reported the statement. | The public record cited here does not establish the exact data categories or technical entry point. |
“Top U.S. investment advisers” is descriptive shorthand, not an official regulatory category or a complete list of every affected firm.
What ShinyHunters claimed—and what that proves
ShinyHunters’ conduct, as reported, involved stealing business or client information, demanding payment and threatening to publish the material. That is often called data extortion or “double extortion”; it differs from conventional ransomware that encrypts a victim’s systems.
Free tools Windows power users keep installed
One-click scans. No signup required.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
A threat-actor listing proves that a claim was made. It does not by itself prove that the named company was breached, that a sample is authentic, that the records are current, or that the count represents unique people. A “record” could be a document, email, duplicate entry or other database item.
Evidence becomes stronger when it is supported by an official company notice, a regulator filing, a court complaint identifying the incident, a forensic or threat-intelligence report, or independently tested leaked samples. Litigation complaints are still allegations, not judicial findings. Screenshots and ransom deadlines are the weakest form of evidence and should not be treated as confirmation.
Was this a hack of clients’ investment accounts?
There is no evidence in the cited reporting that ShinyHunters directly moved client investments, emptied brokerage accounts or obtained trading authority. The reported issue concerns information held by advisory businesses, such as CRM, document or corporate records.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
That distinction does not make the incident harmless. Names, contact details, Social Security information, legal documents and emergency-contact data can support identity theft, convincing impersonation, fraudulent account-recovery requests and targeted phishing or voice phishing. A client should therefore treat unexpected calls or messages as a potential fraud attempt, while not assuming that portfolio assets were stolen merely because an adviser appears in a breach report.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What information may be exposed?
Reported categories differ by firm and by the quality of the source:
- Mercer: Lawsuit allegations referenced names, contact details, full or partial Social Security numbers, emergency contacts, legal documents and other personal information.
- Pathstone: The reported ShinyHunters claim referenced personally identifiable information and internal corporate documents.
- Beacon Pointe: The company’s public statement cited in the reporting did not specify the categories in this article’s source material.
Do not infer that passwords, brokerage account numbers, tax returns, portfolio positions or authentication codes were exposed unless the affected firm or an authoritative notice specifically says so. Former clients, prospects, household members listed as emergency contacts, employees and contractors can also appear in retained CRM or administrative records.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
How the broader campaign appears to work
In a March 2026 alert, FINRA warned member firms that ShinyHunters was targeting public-facing Salesforce Experience Cloud sites, misconfigured guest-user profiles and exposed data or API endpoints. The warning said information obtained this way could be used for targeted phishing, voice phishing and extortion.
The nuance matters: the alert does not say that Salesforce’s core service was universally “hacked.” A customer’s guest permissions, public portal design or API exposure can make data accessible even when the underlying platform is operating as designed. FINRA’s warning supports a sector-wide pattern, but it does not prove that Mercer, Pathstone and Beacon Pointe all used the same initial-access route.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteSeparate reporting has linked ShinyHunters-associated activity to social engineering, compromised identities, malicious OAuth consent and trusted SaaS integrations. Those techniques provide campaign context, not firm-specific proof. The Hacker News described Microsoft’s mapping of several Salesforce-related attack paths, while TechRadar Pro covered broader actor claims. Neither source establishes the entry point for each adviser named here.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Why wealth managers are attractive targets
This is an analytical explanation rather than a statement attributed to ShinyHunters. Advisers aggregate valuable identity information and serve executives, business owners, family offices and high-net-worth households. Their files may reveal trusts, legal matters, corporate relationships, transaction histories, family contacts and staff information.
Cloud CRM, identity, document-management and client-portal systems also create concentrated access points. Stealing that information can enable fraud and reputational damage even when no money is transferred directly. The value to an attacker is therefore not limited to a single account balance.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Legal and regulatory consequences
The Mercer complaints reportedly alleged inadequate multifactor authentication, credential protections, security audits, risk assessments and incident response. Those are plaintiffs’ allegations, not established findings. Putative class actions can still impose substantial discovery, notification, remediation and legal costs.
Recommended Free Tools
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
Firms may also face state breach-notification requirements and scrutiny under federal privacy and financial-services expectations. The applicable duties depend on the firm’s structure, the affected information, the states involved and what an investigation establishes. FINRA said its alert may help member firms develop or modify policies intended to meet applicable obligations, while noting that relevance varies with a firm’s size and business model.
What clients and other affected people should do
- Verify the notice independently. Use the adviser’s established website or a phone number you already have—not contact details in a suspicious breach email.
- Ask precise questions. Request the incident date, whether your information was confirmed involved, and the specific categories affected.
- Change reused passwords. Start with email, financial portals and any account that shares credentials.
- Turn on phishing-resistant MFA. Use passkeys or hardware security keys where offered; otherwise use an authenticator application rather than SMS when practical.
- Monitor accounts and communications. Review brokerage, bank, card, email and mobile-carrier activity, including password-reset and new-device alerts.
- Consider a credit freeze or fraud alert. This is especially relevant if a confirmed notice says Social Security numbers or identity documents were involved.
- Assume impersonation is possible. Do not disclose one-time codes, approve an unexpected login or OAuth request, move money at a caller’s direction, or install remote-access software.
- Report suspected fraud promptly. Contact the institution through a known channel and use the appropriate government identity-theft reporting process.
A former client, prospect, emergency contact or employee should follow the same process if an official notice says their information was included. If no notice has arrived, do not treat a threat-actor list as proof; contact the firm through a trusted channel and ask whether notifications are still being issued.
What advisory firms should review
- Salesforce Experience Cloud guest-user permissions, public pages and API exposure.
- OAuth connected-app inventories, consent history and token revocation procedures.
- Phishing-resistant MFA for workforce and privileged accounts.
- Bulk-export, unusual API and anomalous-login detection.
- Privileged-access controls and session monitoring.
- Data minimization, retention and vendor-access reviews.
- Log retention sufficient for forensic investigation.
- Notification playbooks covering clients, former clients, prospects, employees and emergency contacts.
- Threat-informed exercises for vishing and help-desk account recovery fraud.
Salesforce’s role should be assessed alongside identity providers, document systems, portals and third-party integrations. A platform’s name alone does not identify the control failure.
What remains unknown
- Whether every dataset advertised by ShinyHunters is authentic and complete.
- Whether the named firms shared one intrusion path.
- How many unique individuals correspond to the reported record counts.
- Whether account credentials, account numbers or portfolio data were included.
- Whether additional advisers were affected but have not publicly disclosed incidents.
Until firms, regulators, courts or credible forensic reports resolve those questions, the most accurate description is a credible wealth-management data-extortion campaign with unevenly verified scope—not a confirmed theft of clients’ investment assets.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
