The Mercer Advisors data breach through the essential eight: lessons and analytical limits

1 Introduction

On 22 January 2026, Mercer Advisors Inc., a wealth management company, became aware of suspicious activity within its computer network, which continued through 25 January 2026, indicating that a data breach had occurred. Cybercriminals gained access to files containing the personally identifiable information of 143,000 individuals (Murphy Law Firm, 2026). As reported by the media, the types of personally identifiable information exposed included names, dates of birth, government-issued identification numbers, financial information, Social Security numbers, addresses, and medical information (Claim Depot LLC, 2026; Murphy Law Firm, 2026).

The media reported that, on 15 February 2026, ShinyHunters posted a claim on the dark web about an attack on Mercer Advisors Inc., and, on 18 February 2026, released the stolen data after Mercer refused to pay the ransom. On 31 March 2026, Mercer Advisors Inc. disclosed the breach to the Attorney General’s office (Claim Depot LLC, 2026).

According to the official notification issued by the California Attorney General, Mercer Advisors Inc. wrote to its affected clients on 31 March 2026. The company stated that it experienced a cybersecurity incident on or around 22 January 2026 involving unauthorized access to data stored on certain network systems. On 25 March 2026, the company-led investigation found that an unauthorized third party had accessed certain affected clients’ personal information (Attorney General’s Office, 2026). Against this backdrop, this study aims to present a theoretical perspective on the data breach and uses the Essential Eight mitigation framework to analyze strategies for mitigating cybersecurity breaches (Australian Signals Directorate, 2023).

2 Theoretical lenses

The Mercer Advisors Inc. security compromise prompts us to revisit the theoretical positions used to explain security failures in cyberattacks. It sits within the larger picture of cyberattacks, as two-thirds (67%) of cyberattacks are attributed to malicious and criminal attacks (Office of Australian Information Commissioner, 2023). Three theories are considered in this study.

The Routine Activity Theory identifies the offender (ShinyHunters), the victim (Mercer Advisors Inc.), and the absence of guardians taking due care over the personally identifiable information found in client files (Miró, 2014). To maintain uninterrupted operations, organizations can prepare for zero-day attacks by setting thresholds for hosts and networks with alerts, monitoring, and escalation mechanisms and regularly backing up data to enable a low-latency response. These routinized activities serve as detective and preventive measures; however, they become irrelevant when personally identifiable information assets are stolen, as cybercriminals can then illegally own and monetize these assets for private gain. In such events, the Routine Activity Theory is insufficient to offer a comprehensive explanation (Leukfeldt and Yar, 2016).

The Swiss cheese model of accident causation (Reason’s theory) shows the importance of having a robust, multi-layered security system to mitigate risk, particularly when an organization holds clients’ personally identifiable information (Reason, 1990). The model allows us to understand and reflect on the root causes of security breaches, including whether a given cyberattack could have been avoided or mitigated before causing harm. Although not every security lapse leads to a security breach, analyzing an organization’s security posture can help address security concerns through cost–benefit analysis. Organizational factors to consider include corporate culture, processes, and resource deployment. Supervisory factors include insufficient oversight of security personnel, management overrides of security policies and procedures, and a lackluster approach to risk management. Environmental factors can serve as preconditions for cyberattacks, including the tools and technology used, the physical layout, and the safeguards in place for security assets. Personal factors contributing to security breaches include staff members’ cognitive and emotional conditions and their fitness to serve as security staff members on an ongoing basis (Wiegmann et al., 2022). However, it is not known whether a multi-layered security compromise led to the breach and, if so, which factors were the root cause.

The technology threat avoidance theory suggests that individuals evaluate threats by reflecting on their severity and susceptibility. Users employ three cognitive approaches to appraise threats: severity to assess impact and susceptibility to assess vulnerability. Users may not control their personally identifiable information when they pass it to another organization for safekeeping, and they expect that organization to safeguard it. A security breach can occur when a threat actor directly attacks the organization. The second approach is for threat actors to attack users directly to steal personally identifiable information from them. The third approach is that, because users have different levels of risk tolerance, they become a gateway for threat actors to access personally identifiable information held in the custody of organizations (Liang and Xue, 2009). Overall, the defense-in-depth security approach involves layering physical, administrative, and technical controls (Sinan et al., 2025). It is not known whether ShinyHunters directly attacked Mercer Advisors Inc. or gained access through users.

3 Relevant risks and threats

Multi-factor authentication is one of the essential preventive controls recommended by the Australian Signals Directorate. The Essential Eight is a risk-level maturity model for assessing security breaches, and the Australian Signals Directorate allows organizations to select a target maturity level appropriate to their risk profile and encourages them to progressively implement the corresponding security controls. This article does not make claims regarding the Essential Eight or Maturity Level Three that are not adequately supported by the analysis presented.

The Essential Eight is a non-binding, risk-based benchmark for assessing security posture (Australian Signals Directorate, 2023; Australian Signals Directorate, 2023). The Australian Signals Directorate (ASD) Essential Eight is a set of preventive controls that prioritizes mitigation strategies for Maturity Level Three (Australian Signals Directorate, 2023). The eight strategies are as follows: (1) patch applications, (2) patch operating software, (3) multi-factor authentication, (4) limit administrative privileges, (5) application control, (6) restrict Microsoft Office macros, (7) harden user applications, and (8) regular backups (Australian Signals Directorate, 2023).

The STRIDE model classifies and helps us assess risks to attain different risk maturity levels by mapping them against STRIDE threats to form a defense-in-depth strategy (Australian Signals Directorate, 2023). The STRIDE threats are controlled using the ASD Essential Eight’s minimum controls. Media reports pointed to a compromise of multi-factor authentication (#3); however, such a compromise can be facilitated by not keeping up with the remaining Essential Eight controls, such as patch applications not being up to date (#1), operating software patching not being current (#2), issues relating to compromised administrative privileges (#4), and security weaknesses in applications (#5).

The author’s analysis shows that STRIDE can be mapped to the ASD Essential Eight, and each Essential Eight control can address one or more risk categories: Spoofing (S), Tampering (T), Repudiation (R), Information Disclosure (ID), Denial of Service (DOS), and Elevation of Privilege (EOP). Patching applications (#1), patching operating software (#2), and application controls (#5) address T, ID, DOS, and EOP. Multi-factor authentication (#3) addresses S, R, ID, and EOP. Limiting administrative privileges (#4) is associated with T, R, ID, DOS, and EOP. Restricting Microsoft Office macros (#6) is associated with S. Hardening user applications (#7) addresses all risk categories. Regular backups (#8) are associated with T and ID.

Mercer Advisors Inc. has maintained the following defense-in-depth strategy controls. For technical controls, these include: (1) encryption, (2) multi-factor authentication for staff and the client portal, (3) endpoint detection and response, (4) firewalls, (5) 24/7 Security Operations Center surveillance, and (6) an in-house Customer Relationship Management (CRM) platform that maintains a single source of truth for client data. Administrative controls include (1) verification of wire transfers initiated by email via telephone calls, (2) restricted access to systems containing sensitive client data, and (3) staff awareness training on phishing. Physical controls include (1) restricted access to the office, which requires badges and keys, and (2) visitor monitoring through security cameras.

Mercer Advisors Inc. has implemented a suite of security controls recommended by the National Institute of Standards and Technology (NIST) to protect client data. However, it is argued that, based on the general description, some best practices recommended by the Federal Trade Commission (FTC) appear not to have been comprehensively utilized (Pepper et al., 2023).

Media reports questioned whether Mercer Advisors Inc. adhered to Federal Trade Commission (FTC) recommendations. Based on media reports and the author’s analytic work, a perceived assessment of shortfalls against the FTC-recommended best practices is as follows. (1) Implementing strong, unique passwords with MFA: Not implemented for all personally identifiable information (PII) and sensitive files. (2) Using end-to-end encryption: Implemented. (3) Limiting access to sensitive data: Not implemented for all PII-sensitive files. (4) Training staff on security risks: Implemented. (5) Auditing third-party vendors: Insufficient information to draw a conclusion. (6) Creating a data breach response plan: Did not respond to affected clients on time. (7) Regularly backing up data: Insufficient information to draw a conclusion. (8) Data breach response: Consulting law enforcement: Insufficient information to draw a conclusion. (9) Data breach response: Designating a single point person for communication: Insufficient information to draw a conclusion. (10) Data breach response: Providing at least a year of free credit monitoring to affected individuals: Insufficient information to draw a conclusion.

4 Discussion

In recommending preventive actions, the routine activity theory reminds us to prepare for the worst and recover from incidents such as zero-day attacks while taking preventive, detective, and corrective actions on actual and potential security breaches. The Swiss Cheese Model supports the use of a defense-in-depth strategy. Based on the author’s analytic work, using post-mitigation as a strategy to improve security posture, system security can be improved through a defense-in-depth approach (integrating physical, technical, and administrative safeguards) and targeted control functions, as outlined in Table 1.

Table 1. Recommendations based on the defense-in-depth strategy.

Mercer Advisors Inc. may have upheld higher ethical standards by refusing to pay the ransom to ShinyHunters and accepting the resulting adverse reputation and diminished trust. On the other hand, the personally identifiable information of affected clients was compromised, which can have unforeseen consequences.

Even if a ransom is paid, threat actors such as ShinyHunters have already seen the data by temporarily and illegally possessing the stolen assets, and there is no certainty that all traces have been destroyed as part of a ransom settlement. Consequently, Mercer Advisors Inc. was faced with an acute ethical dilemma of whether to follow the teleological (i.e., what action brings the greater good) or deontological (i.e., what is the right thing to do versus the wrong thing to do) ethical strand, given ShinyHunters’ demand for a ransom payment. Based on the media-reported information, the security breach has created a legal dilemma because personally identifiable information must be protected by law (Gramm-Leach-Bliley Act, 1999).

The final question to reflect on is whether ShinyHunters overcame the defense-in-depth strategy through their investment in security expertise or merely exploited security lapses. No baseline security control framework offers foolproof security, and skilled criminals can circumvent these foundational defense principles with new tradecraft and by exploiting weaknesses that can occur through human behavior (Australian Signals Directorate, 2023).

5 Conclusion

The article used public sources of information available until July 2026, which require scientific validation and verification; therefore, this article treated the information as assertions. These public sources may be useful for identifying allegations, but they are not sufficient on their own to establish the cause of the breach, the scope of the controls in place, or legal liability. Publicly available information does not establish the attack vector, the security controls actually deployed, or the cause of the breach. Confirmed official information is sparse at this stage (Attorney General’s Office, 2026). Accordingly, the Australian Signals Directorate’s Essential Eight served as the primary evaluative framework for the analysis (Australian Signals Directorate, 2023; Australian Signals Directorate, 2023).

Technical frameworks such as the Essential Eight and STRIDE help inform security-governance assessments; however, they do not themselves establish statutory duties, legally applicable standards of care, breach, causation, or liability.

The key facts of the security breach are still developing; media assertions, other publications, and allegations leveled against Mercer Advisors Inc. may not constitute valid evidence. It is not known whether Mercer Advisors Inc. intends to disclose more than what is required by law, as such information may be confidential and not necessarily be relevant to stakeholders. The facts laid out in this article do not take a position on the guilt or innocence of Mercer Advisors Inc. or the sources of the publications on which this article relies.

Generative AI statement

The author(s) declared that Generative AI was not used in the creation of this manuscript.

Any alternative text (alt text) provided alongside figures in this article has been generated by Frontiers with the support of artificial intelligence and reasonable efforts have been made to ensure accuracy, including review by the authors wherever possible. If you identify any issues, please contact us.

Publisher’s note

All claims expressed in this article are solely those of the authors and do not necessarily represent those of their affiliated organizations, or those of the publisher, the editors and the reviewers. Any product that may be evaluated in this article, or claim that may be made by its manufacturer, is not guaranteed or endorsed by the publisher.

Footnotes

Edited by: Tanja Pavleska, Institut Jožef Stefan (IJS), Slovenia

Reviewed by: Ashutosh Soni, C.V. Raman Global University, India

Ahod Alghuried, Prince Sattam Bin Abdulaziz University, Saudi Arabia