Mercer Advisors, a registered investment advisor, allegedly experienced a data breach in February 2026. The ShinyHunters extortion group claimed responsibility, stating they leaked approximately 5.7 million client records (including duplicates) on the dark web after an unmet ransom demand. As of the latest reports, there has been no official confirmation from Mercer Advisors, nor have any state Attorney General filings or breach notification letters been issued.
The alleged breach may have involved various types of client personally identifiable information (PII), including full names, contact information, addresses, emergency contact details, full or partial Social Security Numbers (SSNs), employee training documents, and client contracts with PII of clients and Mercer representatives, along with other legal and investment documents. The dataset size for Mercer was reported as 5GB. It remains unclear which specific states were affected by this incident.
Details surrounding this alleged data breach are still emerging, and official validation is pending. Notices to affected individuals, if required, may be delayed.