A Georgia wealth-management firm showed up on a ransomware leak-site tracker overnight. Ransomware.live indexed Merit Financial Group as a claimed victim of the Storm ransomware group at 2026-10-19 06:55 UTC (about 2:55 a.m. ET Monday), with an estimated attack date of Oct. 19. No data size, ransom demand, or file inventory was disclosed on the tracker page we reviewed.
Public records and the firm's own materials describe Merit Financial Group, LLC, doing business as Merit Financial Advisors, as a wealth-management firm headquartered at 2400 Lakeview Parkway, Suite 550, Alpharetta, Georgia. The company website (meritfa.com) presents financial planning, wealth management, life-transition, and insurance-planning services, and states that Merit has 70+ offices nationwide. We are writing about this Alpharetta-based Merit Financial Advisors / Merit Financial Group — not Merit Advisors (an unrelated energy-tax firm) or other businesses that share the "Merit" name.
What's claimed, and what's confirmed
Claimed: Storm added Merit Financial Group to its leak site. A listing is an actor assertion that the organization is a victim. It is not proof of what, if anything, was taken. The group's blurb recycles marketing-style copy about Merit's broker-dealer and RIA support model and cites older asset figures; we are not treating those figures as a current, verified inventory of client data, and we are not repeating every detail from the actor text.
Not confirmed: As of Monday morning we found no statement from Merit, no SEC or state securities notice, and no news report confirming a breach. Aggregator pages that mark the listing as unverified match what we see: there is no confirmed encryption, no confirmed theft of client account or personally identifiable information, no reported trading or portal disruption, and no word on any payment. Treat this as a claim until the firm says otherwise.
Why it matters to RIAs, broker-dealers, and their clients
Wealth-management offices hold the kinds of records criminals love to impersonate: account numbers, beneficiary details, wire instructions, tax documents, and the trusted advisor relationship itself. Even a claim-level headline is enough for phishing. Expect "urgent account update," "custodian mismatch," or "wire confirmation" emails that borrow the firm's name and the news of a leak-site listing.
Clients of any Alpharetta, Atlanta, or Southeast advisory office should slow down on unexpected requests to move money or change login credentials. Advisors and home-office staff should assume criminals will test AP, operations, and advisor inboxes with fake custodian alerts and fake client requests that use the same language as real ones.
Ask the practical question: if email and the CRM or planning portal went dark for a week, could the office still reach the custodian, process time-sensitive trades from a known number, and warn clients before a fake "account remediation" email lands?
Clear takeaway
Treat Storm's claim against Merit Financial Group / Merit Financial Advisors as a continuity and client-scam drill for RIAs, independent broker-dealer offices, and wealth-management teams. Protect MFA on email and custodian portals, keep restorable backups, and call back on any wire or account-change request, no matter what a leak site alleges.
Actions to take this week
- Require MFA on email, CRM and financial-planning tools, custodian and clearing portals, document vaults, and remote-access tools. Retire shared ops logins.
- Check leaked-credential exposure for your domain and force resets on anything that shows up, starting with principals, ops, advisors with wire authority, and anyone with custodian admin rights.
- Confirm backups you can restore of CRM, planning files, and document stores, with one copy that cannot be changed or deleted. Test a restore this month.
- Make a call-back list for custodians, clearing firms, and your bank, using numbers from contracts, and use it before changing any wire, ACH, or standing instruction.
- Brief advisors and client-service staff: slow down on urgent "account update" or "custodian alert" emails; warn clients that the firm will never ask for passwords or one-time codes by email.
- Write a one-page incident card: who leads, who calls compliance, your insurer, IT provider, and key custodians, and how the office keeps serving clients if email is down.
Brotherly Technology helps financial-services firms and other SMBs across Rome, Northwest Georgia, Atlanta, Chattanooga, Tennessee, and the Southeast turn ransomware headlines into a short readiness review covering MFA, backups, vendor access, and payment-change controls. If you want a second set of eyes before the next claim lands, give us a call.
Sources:
- Ransomware.live: Merit Financial Group / Storm. Discovered 2026-10-19 06:55 UTC; est. attack date 2026-10-19; no data size; claim-level only.
- Merit Financial Advisors (meritfa.com). Context: Merit Financial Group, LLC d/b/a Merit Financial Advisors; Alpharetta, GA headquarters; wealth management / financial planning. No incident acknowledgment cited here.