Storm Ransomware Group Claims Attack on Merit Financial Group

A ransomware group calling itself Storm claims it took data from Merit Financial Group, a US wealth manager. The claim is unverified, with no company statement or second source yet.

By USA 24 Editorial TeamOctober 19, 20265 min read

Dim boardroom at dusk with rain on tall windows, a closed leather folder on a long table and a softly glowing screen on the wall. — Illustration: USA 24

ShareX Facebook LinkedIn Reddit Email

A ransomware group calling itself Storm says it has taken data from Merit Financial Group, a US wealth management firm. The claim went up on a leak site on October 19, 2026. If it holds up, it would be a serious Merit Financial Group data breach, but no one has confirmed it yet. There is no company statement, no regulator filing and no second independent source, so everything below should be read as a claim, not a finding.

What the Merit Financial Group data breach claim says

The claim surfaced in DeXpose, an intelligence feed that aggregates threat posts. According to DeXpose, Storm listed Merit Financial Group under the domain meritfinancialadvisors.com and described it as a leading US wealth management firm. The group says it will leak sensitive data unless the company starts negotiations.

The threat itself is short. The leak-site post reads: "The full leak will be published soon, unless a company representative contacts us via the channels provided." DeXpose presents that text as the group's statement, but it is a threat posted on a leak site, not a verified message to the company or to a journalist. Attribution is the first thing to check, and it has not been checked yet.

The listing leaves out the details readers would most want. It does not say what kind of data Storm holds, how many clients might be affected or how the group got in. It also does not state a ransom amount. The only concrete instruction is to make contact.

Why the claim is still unverified

Leak-site claims come from the groups themselves, and they often sit unconfirmed for days or longer. Some are accurate. Others overstate what was taken, name the wrong company or come from a group that is bluffing. A claim becomes much more reliable when one of three things happens: the victim acknowledges it, a regulator filing appears or a breach notice reaches affected people.

None of those signals has appeared for Merit. The research behind this article did not turn up a company statement, and it did not find a profile of Storm that would show whether the group has published accurate claims before. Without that history, there is no way to weigh the group's word against its record.

DeXpose is an aggregator, not an original reporter. It passes along what groups post, so its accuracy depends on the underlying post. That makes this a single-source lead. A reporter confirming it would start with basic checks: whether the listed domain belongs to the firm, whether the firm's website or client portal shows an outage or notice, and whether any regulator has received a filing that names the company. Those checks had not produced results at the time of writing.

How it fits the N0n posts in the same feed

The Storm claim is not the only recent post in the feed. The same aggregator lists several claims from a different group, N0n. One targets Finzly Corp, a US fintech that USA 24 has already covered in its earlier story on the N0n leak-site listing. According to HookPhish, that listing is part of a run of claims against US companies.

Two more N0n claims show how wide the spread is. DeXpose reports a US healthcare support provider it calls Company #93. HookPhish logged a claim against a Texas managed IT services firm it calls Company #80, dated October 16. Taken together, the feed shows at least three US-listed N0n claims between October 16 and 19.

Storm and N0n are separate groups with separate victims, so the Merit item should not be folded into the N0n story. What they share is timing. Both appear on leak sites within a short window, which fits a pattern of groups posting victims in batches. That pattern alone does not prove coordination, and nothing in the research establishes it.

What a confirmed breach would mean for clients

If Storm's data proves real, Merit's clients are the people most exposed. Wealth managers hold account numbers, personal identifiers, tax information and records of holdings. That mix is valuable to extortion crews, and it also helps scammers sound credible when they contact a client. Someone who receives a call that mentions their advisor and real account details is more likely to act on it.

The notification process would depend on what was taken and where clients live. Most US states require notice to residents when certain personal information is exposed, and firms registered with the SEC or members of FINRA can face additional obligations. The specific rules that would apply to Merit were not verified for this article, so treat this as the general framework rather than a forecast of the firm's response.

Timing matters as well. Breach notices can take weeks to arrive after a company investigates, which is why an unconfirmed claim still matters now. Clients who wait for a letter could learn about the problem from a fraudulent transaction first.

What clients should do now

Clients do not need to panic over a leak-site post, but a few steps make sense today. These are general steps, not specific advice from Merit.

Check any notice from Merit against contact details you already have on file, not links or phone numbers inside the message.
Turn on multi-factor authentication for brokerage, banking and email accounts. An authenticator app or security key is stronger than codes sent by text.
Call your advisor on a number you already know and ask whether the firm has sent any notice. Treat unsolicited calls, texts or emails that cite the firm and ask for logins, codes or payments as likely fraud.
Review account statements for transactions you do not recognize. If a breach is confirmed, a credit freeze at Equifax, Experian and TransUnion is free and blocks new credit accounts opened in your name.

What to watch next

Three developments would turn this from a claim into a confirmed incident: a statement from Merit, a state regulatory filing that names the firm, or a breach notice to clients. Each would show whether data was taken and roughly how many people are affected. Until one appears, the Merit listing remains a single-source lead.

Watch the leak site as well. If Storm publishes files, outside researchers may be able to compare them with what the firm is known to hold, which would be stronger evidence than the threat alone. If the listing disappears without explanation, that would not settle the question, but it would change how much weight the claim deserves. The coming days should show whether this is a real breach at a US wealth manager or another unproven post in a busy week of leak-site claims.

Frequently asked questions

Has Merit Financial Group confirmed the ransomware attack?

Not as of this research. No company statement, regulator filing or breach notice had been found, and the only source for the claim is a leak-site listing relayed by the DeXpose intelligence feed. Until one of those confirms it, the attack should be treated as unverified.

Who is the Storm ransomware group?

The reporting available here does not include a profile of Storm, so its history and track record are unknown. The group posted the claim on a leak site, where it threatens to publish data unless the company makes contact. Leak-site claims come from the groups themselves and often need checking before they are treated as fact.

What should Merit Financial Group clients do now?

Check any breach notice against contact details you already have, and turn on multi-factor authentication for financial and email accounts. Be wary of unsolicited calls or emails that cite the firm and ask for logins or payments. If a breach is confirmed, a credit freeze at the three major bureaus is free and can block new credit fraud.

How can you tell if a leak-site claim is real?

Look for confirmation from the victim, a regulator filing or a formal breach notice, since these are the usual signals that a claim holds up. Security researchers also compare any published data against what the company is known to hold. A claim that has not been confirmed in one of these ways should be treated as unverified.

Sources

#Ransomware #Data Breach #Wealth Management #Storm Ransomware Group #Leak Sites

About this article. Reported and produced by the USA 24 newsroom using the sources cited above. Read our editorial policy. Spotted an error? Tell us and we will correct it.