Data Breach Lawsuit Alleges Mercer Advisors Failed to Protect Confidential Info From Cyberattack

New to ClassAction.org? Read our Newswire Disclaimer

Mercer Advisors Inc. and Mercer Global Advisors, Inc. have been hit with a proposed class action lawsuit that alleges the wealth management firm failed to implement adequate safeguards to protect highly sensitive client information that may have been exposed in a February 2026 data breach.

Get class action lawsuit and class action settlement news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter.

The 47-page data breach lawsuit contends that Mercer Advisors knew or should have known that the private information stored on its systems was “highly valuable” to cybercriminals, yet the financial planning firm did not have in place an information security policy consistent with industry standards.

Mercer Advisors, the filing says, was targeted by a notorious decentralized hacking group known as ShinyHunters on or around February 16, 2025, with the group reportedly extracting over 5.7 million individual records.  According to the suit, ShinyHunters has been linked to some of the largest data breaches in history and has a reputation as a “pay and leak” group that demands multi-million-dollar ransoms.

Following the data breach, ShinyHunters reportedly contacted Mercer Advisors seeking a ransom and threatening to release the information it captured during the incident, the class action lawsuit says. The case states that the company chose not to pay, and on February 18 of this year, the illegally obtained information was released onto the dark web.

According to the filing, personal client information that may have been compromised in the Mercer Advisors data breach included names, contact details, full or partial Social Security numbers, emergency contact information, contract documents, legal documents, and other personally identifying information collected by Mercer.

The lawsuit alleges that Mercer Advisory owed a duty of care to clients who entrusted their personal information to the wealth management firm. Despite assurances that it had reasonable cybersecurity measures in place, the firm failed to implement even “basic protections,” the suit alleges.

The case says that industry standards and Federal Trade Commission guidelines dictate that, because of the private and valuable information involved, wealth management firms should, at a minimum, use multi-factor authentication, encrypt personally identifying information, have effective intrusion detection and logging, properly dispose of information that is no longer needed, and conduct regular security audits and risk assessments.

The lawsuit asserts that because of the data breach, the plaintiffs potentially face “years” of fraudulent activity in their name, phishing attempts, and extortion attempts from cybercriminals. The plaintiffs, according to the suit, will need to engage in “ongoing and constant” monitoring of their financial information and account activity to protect themselves.

The Mercer Advisors class action lawsuit seeks to cover all individuals in the United States whose private information was accessed and/or acquired by an unauthorized party because of the data breach.

Looking for current class action lawsuits to join? Check out ClassAction.org’s class action lawsuit list.