HackingFinancial ServicesFinanceStolen CredentialsData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

Mercer Advisors Inc.

bd_f0e3ca9ef62041f1 · schema v1 · pii pii-v2

Severity

Medium

Discovered

Jan 22, 2026

Filed

Mar 31, 2026

To disclose

10 weeks

Affected

514state residents only

Linked

10 filings

Confidence

66%

Full breach record for Mercer Advisors Inc. →2 incidents on file

Mercer Advisors Inc. disclosed a cybersecurity incident affecting Montana residents. Unauthorized access occurred around January 22, 2026, involving client systems. Affected data included names, contact info, driver's licenses, government IDs, DOB, and account numbers. The incident was contained, and law enforcement was notified. Affected individuals were offered two years of credit monitoring.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >30d10 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 10 weeks / 68 days

Jan 22, 2026

Begins

Jan 22, 2026

Discovered

Mar 31, 2026

Filed

vs. sector median

+1 wks slower

This filing is one of 10 about the same incident.View merged incident

A leak claim by shinyhunters about this victim predates this filing by 37 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteshinyhuntersbd_74d6e3e7644e603d2026-02-21 · +38dVerified

Regulatory filings (8) · sorted by filing gap

Massachusetts State AGbd_0a5f73a7f4b8af802026-03-31Verified by operator
Nebraska State AGbd_17b4a213c92589c22026-03-31Verified
California State AGbd_41c52380b4cba0f82026-03-31Verified by operator
Vermont State AGbd_7a9028119074fbf32026-03-31Verified by operator

Show 4 more filings ↓up to 17d gap

Washington State AGbd_c9cf67fb541b27502026-03-31Verified
Indiana State AGbd_cf90fb475588f3162026-03-31Verified
Texas State AGbd_7434b0177f07c09a2026-04-02 · +2dVerified
Oregon State AGbd_4c2c111384c827792026-04-17 · +17dVerified

Name: Mercer Advisors Inc.
norm: mercer advisors
Domain: merceradvisors.com

Name: Mercer Advisors Inc.
norm: mercer advisors
Domain: merceradvisors.com
Industry: Financial Servicesllm

Discovered: Jan 22, 2026
Breach occurred: Jan 22, 2026
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 31, 2026
Affected individuals: 514state-resident count only
Data types: Identity (basic)Government IDFinancial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Regulator citations: reported the issue to law enforcement authorities
Initial access: exploit_public_facing

During the incident: Began working with leading external cybersecurity experts
Blocked the unauthorized party’s access to our systems
Took additional steps to enhance our safeguards
Reported the issue to law enforcement authorities
Changes made: Offering a two-year IdentityWorks Credit Plus membership from Experian
Change your account password directly with your custodian
Change their account number(s)
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(68 days from discovery to filing)
Compliance flags: Leak >30d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 9 states

View merged incident ↗

Massachusetts State AGMar 31 · first

Nebraska State AGMar 31 · first

California State AGMar 31 · first

Vermont State AGMar 31 · first

Washington State AGMar 31 · first

Indiana State AGMar 31 · first

Montana State AGMar 31 · first · this page

Texas State AG+2d

Oregon State AG+17d

Pattern: first filing Mar 31 (MA), last Apr 17 (OR) — a 17-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/2026/09/Consumer-notification-letter.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 31, 2026
Raw hash: 8da421b28ab58827646540278c98e72234c8e1d610caf7ae38cb577417dbfc8a

Linked disclosures

Ransomware claims (1)

Regulatory filings (8) · sorted by filing gap

Reporting entityMercer Advisors Inc.

Victim entityMercer Advisors Inc.

Incidentdiscovered Jan 22, 2026

Stated responseBegan working with leading external cybersecurity experts

ComplianceLeak >30d

Extraction provenanceno artifact recorded

Source provenancedojmt.gov