A ransomware group called Storm claims to have breached Johnson Investment Counsel, a Cincinnati wealth management firm managing about $23 billion in client assets across all 50 states. The exact data exposed and number of affected individuals have not been publicly disclosed. Affected clients should monitor credit reports, consider a credit freeze, and watch for phishing attempts referencing their accounts.
| Company | Johnson Investment Counsel |
|---|---|
| Industry | Finance |
| Data Types Exposed | Full Names, Contact Information, Financial Account Details, Investment Portfolio Information, Estate and Trust Planning Records, Social Security Numbers |
| People Affected | Not Publicly Disclosed |
| Attack Method | Ransomware |
| Regulators Notified | Not Publicly Disclosed |
Were you affected by this breach?
You may be owed compensation.
Data breach victims can recover money for identity-theft losses, out-of-pocket costs, wasted time, and the ongoing risk of fraud — usually with no upfront cost, and no fee unless you win.
Check if you qualify — free reviewWhat Happened in the Johnson Investment Counsel Data Breach?
Johnson Investment Counsel, a wealth management firm based in Cincinnati, Ohio, has confirmed a data breach linked to a ransomware group known as Storm. The firm manages roughly $23 billion in assets for clients across all 50 states. As a result, this incident carries wide-reaching implications for individuals and families who trusted the firm with their financial information.
According to available information, a threat actor group identified as Storm claimed responsibility for accessing the company’s systems. The exact breach discovery date has not been publicly disclosed. However, the involvement of a named ransomware group suggests that attackers gained unauthorized access to internal systems before the intrusion was identified.
Details about the specific attack timeline remain limited. In many ransomware cases like this one, attackers infiltrate a network, extract sensitive files, and then use the threat of public exposure as leverage. Because Johnson Investment Counsel operates as a fiduciary handling sensitive financial data, any unauthorized access raises serious concerns for its clients.
Following discovery of the incident, the firm presumably launched an internal investigation to determine the scope of the compromise. Forensic review after a ransomware claim typically involves identifying which systems were touched and what data may have left the network. At this time, the notification date to affected individuals has not been publicly disclosed.
Who was affected?
The population affected by this breach likely includes current and former clients of Johnson Investment Counsel. Given the firm’s fee-only advisory model, this may include individuals, families, businesses, retirement plans, foundations, and nonprofit organizations that relied on its services.
The exact number of affected individuals has not been publicly disclosed. Because the firm serves clients in all 50 states, the geographic reach of this breach could be substantial. In addition, employee data may also be involved, since the company reports having between 51 and 200 employees.
It is not yet clear whether minors are among those affected, such as beneficiaries of trusts or estate planning clients. Nonetheless, given the nature of wealth management services, dependents and family members connected to client accounts could also face indirect exposure.
What Information Was Potentially Exposed?
The full scope of compromised data has not been publicly itemized in detail. However, based on the nature of Johnson Investment Counsel’s services, the exposed information likely includes sensitive financial and personal details tied to investment management and estate planning relationships.
- Full names
- Contact information such as addresses and phone numbers
- Financial account details
- Investment portfolio information
- Estate and trust planning records
- Social Security numbers (where collected for account services)
Because this firm provides fiduciary wealth management, the type of data it holds tends to be highly sensitive. For example, client accounts often include net worth details, retirement account numbers, and beneficiary information tied to estate plans.
As a result, affected individuals face a heightened risk of identity theft and financial fraud. Criminals could use exposed financial account details to attempt unauthorized transactions or open new lines of credit in a victim’s name.
In addition, exposed contact and account information could fuel targeted phishing attempts. Because attackers often use real account details to appear legitimate, victims may receive convincing scam messages referencing their actual investment accounts.
What is the company doing?
In response to the breach, Johnson Investment Counsel is expected to have engaged cybersecurity specialists to assess the extent of the intrusion. Firms handling this kind of incident typically work to contain the threat, secure affected systems, and determine what data the attackers accessed.
Ongoing steps likely include notifying affected individuals once the investigation is complete and offering guidance on protective measures. Because notification and discovery dates have not been publicly disclosed, it remains unclear whether credit monitoring or identity protection services have been offered to those impacted.
What Should Affected Individuals Do?
Monitor Your Credit Reports
Affected individuals should request copies of their credit reports from all three major credit bureaus. Regularly reviewing these reports can help you spot unauthorized accounts or suspicious inquiries early.
You are entitled to a free credit report from each bureau on a regular basis. Because financial data may have been exposed, checking these reports every few months for the next year is a smart precaution.
Consider a Credit Freeze or Fraud Alert
Given the potential exposure of financial account details, placing a credit freeze with each credit bureau can prevent new accounts from being opened in your name. This is one of the strongest protections available to consumers after a breach involving financial information.
Alternatively, a fraud alert makes it harder for identity thieves to open accounts without extra verification. This option is easier to set up and still provides meaningful protection, though a full freeze offers a higher level of security.
Stay Alert for Phishing Attempts
Because attackers may have obtained real client details, they could use this information to craft convincing phishing emails or phone calls. Be cautious of any unexpected messages referencing your investment accounts or asking for personal details.
Never click links or share information in response to unsolicited messages. Instead, contact Johnson Investment Counsel directly using a verified phone number if you have questions about your account status.
Review Financial and Investment Account Activity
Given the nature of the firm’s services, it’s wise to closely review statements from investment, retirement, and trust accounts. Look for any unfamiliar transactions, withdrawal requests, or changes to beneficiary designations.
If you notice anything unusual, report it to Johnson Investment Counsel and your financial institution immediately. Prompt reporting can limit the damage and help resolve fraudulent activity faster.
Consult a Data Breach Attorney
Because this breach may involve sensitive financial data, affected individuals may want to speak with an attorney who focuses on data breach cases. A free consultation can help you understand your rights and whether you qualify for compensation.
Many law firms handling these cases work on a contingency basis, meaning there’s no upfront cost to explore your options. This can be a valuable step if you experience financial harm connected to this incident.
Get a Free Case Review
Tell us how this breach affected you. A data breach attorney will review your situation at no cost and with no obligation — it takes about two minutes.