Andrews Advisory Group LLC Data Breach

N0n posted Andrews Advisory Group LLC on its dark web leak portal on October 25, 2026, as part of a coordinated batch of U.S. victims, and the listing was identified through SOCRadar’s Dark Web Monitoring service. Andrews Advisory Group is a Chicago, Illinois-based financial advisory and restructuring firm operating in the professional services sector. The firm’s client files and organizational records are the kind of sensitive material ransomware actors typically use as negotiating leverage, making advisory practices of this type attractive targets for extortion activity. N0n has been active for at least the past 60 days, posting victims in batches across Professional Services, Healthcare, Manufacturing, and Technology, with a heavy concentration in the United States and a secondary presence in Canada. Law firms and financial advisory practices appear consistently in its listings. Other victims in the October 25 batch include Mach Law APC (Legal, US), Finzly Corp (Financial Services, US), and Hotel DuPont (Hospitality, US). Andrews Advisory Group fits the group’s established targeting profile — U.S.-based, professional services, and mid-market — and the batch timing and sector clustering suggest a deliberate focus on this vertical rather than random selection.

SOCRadar’s stealer-log query for the Andrews Advisory Group LLC domain returned no records in this sample. The query covered only a paginated slice of the available telemetry, which may not represent the full dataset, so the result should be read as an absence of positive signal rather than evidence that the firm is unaffected. Credentials tied to the organization could sit under a staff personal email alias or a sibling corporate domain rather than the queried domain, and relevant records may exist in stealer-log feeds outside the sampled slice. On this basis, exposure cannot be ruled out, and the absence of records should not be interpreted as evidence that no compromise occurred. Although no direct credential correlation was found, the leak-site listing still warrants proactive defensive review. Compromised credentials of the kind tracked in stealer logs can provide a path into corporate environments, potentially reaching corporate accounts, VPN gateways, and remote-access portals; this remains a possible scenario rather than a confirmed access method for this incident, and the negative query result does not exclude it. Supported response steps include monitoring the N0n portal for a potential data release, reviewing credential hygiene for both corporate domains and staff personal aliases, and validating VPN, Microsoft 365, and remote-access portal logs for anomalous authentication in the 30 days prior to October 25, 2026. Continued dark web and stealer-log monitoring, including alternate corporate domains associated with the firm, will help clarify whether the claim develops into confirmed data exposure.