Mercer Advisors Data Breach: 143K People Affected
The 2026 Mercer Advisors data breach involved unauthorized access to systems storing client data between January 22 and January 25, 2026. Records compiling regulatory filings report that 143,104 people were affected.
Exposed Data Types
9- Email addresses
- Names
- Phone numbers
- Physical addresses
- Dates of birth
- Social security numbers
- Driver's licenses
- Government issued IDs
- Financial account information
About This Breach
Mercer Advisors is a US registered investment adviser providing wealth management, financial planning and family-office services.
How was the incident confirmed?
The California Attorney General published Mercer Advisors' breach filing and the incident dates. The company letter published by Massachusetts authorities confirms that an unauthorized party accessed systems holding client data and obtained certain personal information.
Mercer said the incident was contained and reported to law enforcement. At the time of notice, the company said it had no evidence of identity theft or fraud connected with the incident.
When did the breach occur?
The unauthorized access began on or around January 22, 2026 and continued through January 25. Mercer determined on March 25 that personal information had been obtained and mailed notices on March 31.
What information was affected?
Depending on the individual, the affected information could include names, postal and email addresses, phone numbers, dates of birth, Social Security numbers, driver's license or other government-issued ID numbers, and financial account numbers.
Not every data field was affected for every person. Passwords and account-login credentials were not confirmed as exposed.
How many people were affected?
Records compiling regulatory filings report that the breach affected 143,104 people. State filings separately identified 15,486 Texas residents, 7,470 Washington residents, 2,178 Massachusetts residents and 703 Indiana residents.
What should affected people do?
Notice recipients should review investment and custodial-account activity, contact-information changes and transfer requests through known direct channels. Unrecognized activity should be reported promptly to the relevant financial institution.
Review credit reports regularly, consider a credit freeze or fraud alert where appropriate, and independently verify unexpected messages claiming to come from Mercer.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
