Registered investment advisors carry a kind of trust most businesses never have to manage: clients hand over not just personal information, but standing authority to move real money on their behalf. That combination of sensitive data plus transaction authority is what makes them an attractive target, and it’s why cybersecurity for this industry needs to be broader than “do we have good antivirus?”
The Risk Is Already Playing Out
This isn’t hypothetical. In February 2026, wealth management firm Mercer Advisors was breached by a cybercriminal group known as ShinyHunters, which claimed to exfiltrate 5.7 million client records, names, Social Security numbers, emergency contacts, and legal documents. Mercer refused to pay the ransom; the group published the data anyway. Two class-action lawsuits followed, brought by clients who argued the firm hadn’t done enough to protect their information. One incident, and the fallout ran through every layer this article covers: the breach, the regulatory exposure, and the litigation that came after.
The Real Entry Point Isn’t a Technical Exploit
Scott Alldridge, Founder, President & CEO of IP Services and Co-Founder & President of IT Process Institute (ITPI), who has spent three decades studying how breaches actually happen inside real organizations rather than how they’re described in vendor brochures, points to a statistic that should reframe how most firms think about risk: roughly seven out of ten breaches start with social engineering, not a technical exploit. Someone impersonates a trusted party, a client, a custodian, an internal IT contact, and simply asks for something. A password reset. A wire. An updated address on file. It works often enough that attackers keep using it.
Why the Fix Is a Rule, Not a Tool
This is where the distinction between governance and technology matters most, and it cuts against how most firms budget for security. It’s easy to buy a tool and feel covered. Alldridge is blunt about the limits of that instinct: new software creates a feeling of protection, but a control only counts if someone can show it was configured correctly and operating on the day it mattered. Firms with current software and a clean audit have still handed over account access to a caller who simply sounded legitimate, because no one was required to verify first.
For a Registered Investment Advisor, that means the real question isn’t “do we have MFA and a firewall,” but “does every employee know, without hesitation, that no distribution, wire, or account change happens without a callback to a verified number, no matter how legitimate the request looks or how much urgency is attached to it?”
The New Exposure Most Firms Haven’t Reviewed Yet
There’s a second, newer layer of exposure specific to this industry: AI adoption. Advisory firms increasingly use AI tools to summarize meetings, draft communications, and process account data faster. Each one touches regulated client information, and few firms run that adoption through the same scrutiny they’d apply to a new custodian or vendor. A tool that wasn’t evaluated for how it stores or transmits client data can create exposure under SEC and FINRA recordkeeping and privacy obligations before anyone realizes a decision was made. The fix isn’t avoiding AI; it’s treating each new tool as a compliance decision before it touches client data, not after.
Where Cyber Insurance Quietly Falls Short
Cyber insurance adds one more wrinkle worth knowing about. According to the National Association of Insurance Commissioners’ 2025 Cybersecurity Insurance Market Report, 74% of U.S. cyber insurance claims closed without payment in 2024, nearly three out of every four. That’s not identical to “denied”: it also includes claims below the deductible or withdrawn. But the pattern underneath it is what matters.
Alldridge points out that the leading cause of a bad outcome usually isn’t dishonesty on the application; it’s that most organizations don’t know their own security posture precisely enough to describe it accurately. A firm believes it’s covered because it checked a box, then discovers during a claim that the carrier wanted proof, logs, configurations, and documented procedures that nobody was keeping. For a fiduciary, that gap surfaces during a regulatory exam or a client’s worst moment, not a convenient time to discover it.
The Takeaway
None of this requires an enterprise security team to fix. It requires a short list of standing rules, decided in advance and rehearsed until they’re automatic: no money moves or account changes without independent, out-of-band verification; any new AI or software tool gets a compliance review before it touches client data, not after; and the firm can produce, on request, documentation proving its controls were operating, not just installed.
The tools protect the perimeter, but the process protects the client relationship. Firms that write their verification rules down, apply them without exception, and can prove it later are the ones that turn a convincing impersonation attempt into a routine callback instead of a client’s life savings gone and a regulator asking hard questions.
