Pathstone Family Office Wealth Management Breach (2026): Ultra-High-Net-Worth Client Contact Records Exposed

Breach Summary

In February 2026, the extortion group ShinyHunters claimed a breach of Pathstone Family Office, LLC, an ultra-high-net-worth wealth manager with about $170 billion in assets, alleging total exfiltration of its Salesforce environment and internal file systems (~15 GB compressed). The actor claimed roughly 641,000 records and detailed profiles of about 91,257 clients including financial intelligence, client contracts, legal paperwork, and estate-planning details, and set a March 2, 2026 ransom deadline. A DataBreach.com parse of circulating data confirmed contact-level identifiers (names, emails, phone numbers, street addresses) for about 48,246 individuals; the richer financial/estate data remains an actor claim not independently confirmed in circulation. Pathstone had not officially confirmed the incident as of the latest reporting.

About Pathstone.com

Pathstone Family Office, LLC is a large U.S. registered investment advisor and multi-family office serving ultra-high-net-worth individuals and families, operating at least 22 offices nationwide and overseeing more than $170 billion in assets. It aggregates highly sensitive financial, estate, tax, beneficiary, and contact information to manage assets and coordinate advisory work. (Not to be confused with the same-named behavioral-health nonprofit Pathstone Corporation.)

Why They Hold Your Data

Wealth-management firms collect highly sensitive investor identity, financial records, account data, beneficiary information, and advisory relationship records across planning and asset-management workflows.

Recent Developments

ShinyHunters listed Pathstone Family Office on its extortion site on February 27, 2026, with a March 2, 2026 ransom deadline, and later advertised a ~15 GB compressed Salesforce database for sale. Pathstone had not officially confirmed the incident as of the latest reporting; class-action investigations were opened. The attack is part of a wave of ShinyHunters Salesforce-targeted breaches of wealth-advisory firms (also naming Mercer Advisors and Beacon Pointe).

Data Points Exposed

Breach Impact

Because inclusion in Pathstone’s data identifies someone as an ultra-high-net-worth client, exposure carries outsized risk of targeted spear-phishing, advisor impersonation, extortion, and even physical-security threats to wealthy families, beyond ordinary identity-theft concerns. ShinyHunters claims the stolen Salesforce dataset includes detailed client profiles with financial intelligence and estate-planning details, which if released would sharply amplify these risks.

Exploitation & Downstream Threats

• Highly targeted spear-phishing and advisor/wire-fraud impersonation against ultra-wealthy clients | • Extortion leveraging affluent-client status and (claimed) financial/estate data | • Physical-security and kidnapping-risk targeting of wealthy families via exposed addresses | • Doxxing and property targeting from street-address exposure | • Account takeover and social engineering using client contact and profile data

What You Should Do

1. Treat the home address as exposed: review mail and package handling and physical-security routines, and brief household staff to verify unusual requests.
2. Guard against SIM-swap and vishing: add a carrier port-out PIN and verify any 'support' calls independently.
3. Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.

How ObscureIQ Can Help

1. Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
2. Exposure mapping and footprint neutralization: cross-reference against broker-available data and suppress still-removable elements, prioritizing address and phone, since this record re-seeds broker networks.
3. ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).