Merit Financial Advisors Data Breach

A ransomware group called Storm has posted the name of Merit Financial Group, the wealth-management firm known as Merit Financial Advisors, on its leak site. Financial advisors hold some of the most sensitive information their clients have.

On Oct. 19, 2026, Storm listed Merit Financial Group, LLC on its leak site, according to ransomware.live and the threat-intelligence firm SOCRadar, which track these postings. A leak site is where a criminal group names the organizations it claims to have stolen data from, usually to pressure them into paying.

Merit Financial Group is a wealth-management firm based in Alpharetta, Georgia. As of Oct. 30, 2026, the firm has not publicly confirmed a security incident, and Emery | Reddy has not located a notice letter, regulator filing or lawsuit about the claim. SOCRadar labels the claim as alleged and unverified.

Emery | Reddy is investigating the reported breach on behalf of clients who may be affected.

Who Is the Storm Ransomware Group?

Storm is a newer group. It was first tracked in August 2026, according to the data recovery firm Proven Data. The group uses what researchers call double extortion: it claims to steal data, then threatens to publish it unless the victim pays.

According to Proven Data, Storm’s listed victims are mostly in the United States and are concentrated in manufacturing, financial services and healthcare. Proven Data also notes that some researchers suspect the group posts unverified or duplicate claims to look bigger, so a listing alone does not prove data was taken.

The threat-intelligence site DeXpose reported that Storm’s posting threatens to publish a full leak unless a company representative contacts the group.

What Information Could Be Involved?

No data type has been confirmed. Storm has not publicly described what it claims to have, and Merit has not issued a notice.

Wealth-management firms commonly keep detailed records on their clients, which can include:

• Names, addresses and dates of birth
• Social Security numbers
• Investment and bank account information
• Tax documents and financial statements

This list describes the kind of records such firms often hold. It is not a confirmed list of what was taken in this case.

What Is Merit Offering Affected Clients?

Nothing has been announced. If Merit confirms a breach and sends notice letters, those letters should explain what was involved and whether credit monitoring is offered.

Why Financial Records Raise the Stakes

If client records were taken, the risk would go beyond ordinary identity theft. Account numbers and tax records can be used to target investment and bank accounts, file fake tax returns or pose as the advisor in a scam call or email.

Steps clients can take now:

• Review statements from accounts managed through Merit
• Turn on login and transaction alerts with account custodians
• Be cautious with any unexpected request to move money or confirm account details
• Consider a free security freeze with the three credit bureaus
• Keep any letter or email from Merit about a security incident

Do You Have Legal Options?

Financial firms that collect clients’ personal and financial information have a duty to protect it and to tell clients promptly if it is exposed. If a breach is confirmed, affected clients may have legal rights and remedies worth discussing with an attorney.

Contact the Data Breach Attorneys at Emery | Reddy today for a Free Case Review. No Fee Unless We Recover.

Your Personally Identifiable Information (PII) includes information that can be used to identify you, such as your name and other personal details. Organizations that manage healthcare data are legally required to safeguard this information. When PII is exposed in a data breach, it can potentially be used by cybercriminals to commit identity theft, financial fraud, or other misuse.

Frequently Asked Questions

Was Merit Financial Advisors actually hacked?

That has not been confirmed. Storm listed the firm on its leak site on Oct. 19, 2026. As of Oct. 30, 2026, Merit has not publicly confirmed an incident, and no notice letter or regulator filing has been found.

What is a ransomware leak site?

It is a website run by a criminal group where it names the organizations it says it attacked. Groups use these listings to pressure victims into paying, often by threatening to publish stolen files.

What information might be involved?

No data type has been confirmed. Wealth-management firms often hold Social Security numbers, account details and tax records, but only a notice from Merit would confirm what, if anything, was taken.

What should I do now if I am a Merit client?

You do not need to wait for a letter to protect yourself:

• Review your account statements
• Set up alerts with your account custodian
• Verify any request to move money by calling your advisor at a number you already know
• Consider a free credit freeze

How can I avoid scams that mention this incident?

Criminals sometimes contact victims after a breach is in the news. Be careful with any call, text or email that mentions Merit and asks for account numbers, passwords or a wire transfer. Hang up and call your advisor directly.

Do I have a legal claim?

Financial firms have a duty to protect client information and to disclose breaches promptly. If Merit confirms that your information was involved, you may have legal rights. Contact Emery | Reddy at 916.995.5968 or visit emeryreddy.com for a Free Case Review to see what you may qualify for. No Fee Unless We Recover.