Mercer Advisors merceradvisors.com Mercer Advisors data breach 2026: what happened and what to do
Mercer Advisors said an unauthorized party accessed client data around January 22, 2026, and began sending notice letters on March 31. Data varied by person and could include names, contact details, ID numbers, dates of birth and account numbers. The total affected hasn't been published.
View all 13,115 breaches- Breach date
- 22 Jan 2026
- Made public
- 31 Mar 2026
- Data exposed
- Names, Dates of birth, Driver's licenses, Government issued IDs
- Last updated
What happened
Mercer Advisors, a US wealth management and financial advisory firm, told clients that around January 22, 2026 someone gained unauthorized access to systems it uses to store client information. According to the notice letters, Mercer determined on March 25, 2026 that a third party had obtained some personal information, and it began mailing letters on March 31. The incident then appeared on the California Attorney General's breach notification list.
Mercer hasn't published a total number of people affected yet. Two lawsuits allege that the extortion group ShinyHunters leaked millions of Mercer's internal records. Those claims are allegations, and Mercer has not confirmed that figure. Don't confuse this with an earlier, separate incident reported by Mercer Global Advisors in late 2025, which affected 661 people according to a Maine filing.
What was exposed
The notice letters say the data varied from person to person and could include a name, contact information, a driver's license or other government-issued ID number such as a passport number, date of birth and account number. The letters say Social Security numbers were not believed to be included.
That is still a useful set for a fraudster. Name, date of birth and an ID number are enough for many identity checks. Add the knowledge that you are a wealth management client and a scammer has a believable story to call you with.
What it lets criminals do
The biggest danger for an advisory client is impersonation. Someone who knows your advisor's firm, your name and part of your account number can phone, email or text you as "your advisor" and ask you to approve a transfer. Wire and transfer fraud aimed at advisory clients is common, and the losses can be large.
Government ID numbers raise the risk of fake accounts opened in your name, such as phone lines, loans or card applications. If your passport number was exposed, keep an eye out for travel or immigration related scams that use it.
What Mercer has said
Mercer's letters describe an investigation that found a third party had obtained some personal information. Read your own letter for any monitoring offer and its enrollment deadline. If you are a client and didn't receive a letter, call your advisor on a number you already have.
Check your own exposure
Your Mercer letter is the primary source. A free Serus scan also checks whether your email and phone number appear in breaches, and Serus keeps watching and alerts you to new ones. Serus can't remove data from a breach.
About the lawsuits
Class action lawsuits were filed against Mercer after the notices went out. A lawsuit is a claim by the people who bring it, not a finding by a court, so treat the figures in it with caution until Mercer or a regulator confirms them.
What to do if you were in it
- 1
Read your letter and enroll in the monitoring offered
Your notice lists what applies to you. If it includes free credit monitoring, sign up before the deadline.
- 2
Verify any transfer request by phone
If someone claiming to be your advisor asks you to move money, call your advisor back on a number you already had before doing anything.
- 3
Freeze your credit
Freezing your credit at Equifax, Experian and TransUnion is free and stops anyone opening new credit in your name. You can lift it when you need to apply for something.
- 4
Replace a leaked ID if you can
If your driver's license or passport number was exposed, ask your state DMV or the State Department whether replacing it makes sense. Watch for accounts or applications you didn't make.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan to see where your email and phone number have been exposed, and get an alert when they appear in a new breach.
Frequently asked
Was I affected by the Mercer Advisors breach?
Mercer is sending letters to affected people, starting March 31, 2026. If you are a client and haven't received one, contact your advisor using a number you already have.
What data was exposed?
The letters say it varied by person and could include name, contact information, a driver's license or other government ID number such as a passport number, date of birth and account number. Social Security numbers were not believed to be included.
How many people were affected?
Mercer hasn't published a total yet. Lawsuits claim millions of records were leaked, but those are allegations.
Should I change my password?
Passwords weren't listed in the notice. Still, change your portal password if you reuse it elsewhere, and turn on two-factor login.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
