Merit Financial Group Data Breach

Storm listed Merit Financial Group (meritfinancialadvisors[.]com) on its dark web leak portal on October 19, 2026, in a posting identified through SOCRadar’s dark web monitoring. Merit Financial Group is a United States financial services firm providing financial advisory and wealth management services to individual and institutional clients across the country. Financial advisory firms are natural targets for ransomware and extortion activity: client portfolios, account numbers, and investment records represent high-leverage extortion material, and the regulatory cost of a disclosure amplifies pressure to pay. The claim remains unverified, and the listing should be treated as alleged rather than a confirmed breach. The Merit Financial Group listing is one of three Storm claims published on October 19, alongside Patriot Maritime and Baltimore Tank Lines. Over the past 60 days, Storm has run a concentrated US campaign targeting transportation, logistics, and financial services organizations, with a consistent victim profile of mid-size US enterprises holding high-value data and operating with lean security teams. The overlap with this victim is direct in both geography and sector: Merit Financial Group fits Storm’s targeting template precisely as a mid-size US financial services firm whose client data carries significant extortion leverage and regulatory exposure.

SOCRadar’s stealer-log query against meritfinancialadvisors[.]com returned no records, and no positive infostealer indicator was identified for this listing. This result does not confirm that Merit Financial Group is unaffected. The query covers only a bounded, paginated sample, and credentials may exist under alternate corporate domains, personal email aliases, or in feeds not captured in this pull. The absence of stealer-log records therefore cannot be read as evidence that no compromise occurred, and the finding should be weighed against the unverified ransomware claim rather than treated as a clearance. The Storm listing remains unverified, but the potential impact profile is clear. Financial advisory firms hold client data subject to regulatory notification requirements, and Merit Financial Group should assess immediately whether client PII, investment records, or banking credentials may be in scope for the claimed exfiltration. The source assessment recommends assuming data theft occurred and working backward from that assumption rather than waiting for Storm to publish proof. Unauthorized sessions in Microsoft 365 or VPN environments are among the access paths worth checking in this context, although no specific intrusion method has been confirmed for this incident. Defenders responding to this listing should activate incident response without waiting for Storm to publish proof, review Microsoft 365 and VPN access logs for unauthorized sessions in the 60 days before October 19, and identify what client financial data is accessible from internet-facing systems while assessing potential exfiltration paths. Legal counsel should be consulted on SEC and FINRA notification obligations if client financial data is involved, and credentials should be rotated across all systems immediately. Because the stealer-log pull covered only a bounded sample, continued monitoring of stealer-log feeds and checks for credentials under alternate corporate domains remain prudent while the claim develops.