Attorneys at Almeida Law Group are investigating whether a class action lawsuit can be filed on behalf of individuals affected by a possible Johnson Investment Counsel data breach. According to dark web monitoring sources, a hacker group calling itself Storm claimed responsibility for a cyberattack on Johnson Investment Counsel in a post first observed in September 2026, alleging it had gained access to internal company systems. As of this writing, Johnson Investment Counsel has not issued a public confirmation of the incident, and the exact scope of any exposed data remains unknown. If you believe you were affected, contact Almeida Law Group.
About Johnson Investment Counsel
Johnson Investment Counsel is an independent, employee-owned, fee-only Registered Investment Advisor founded in 1965 and headquartered in Cincinnati, Ohio. The firm provides wealth management, financial planning, trust services, estate planning, charitable planning, and asset management through divisions including Johnson Private Client Group, Johnson Trust Company, and Johnson Asset Management. It serves individuals, families, businesses, retirement plans, foundations, and endowments across nearly all U.S. states, managing approximately $23 billion in assets and serving more than 18,000 clients as of mid-2026. Because the firm holds detailed financial and personal information for its clients as part of its core advisory services, a breach — if confirmed — could carry serious risks for those it serves.
What Happened?
On September 18th, 2026, Johnson Investment Counsel was listed as a claimed victim on the dark web leak site operated by the ransomware group known as Storm (tracked by Microsoft as Storm-1175). The claim was observed and indexed by Ransomware.live. No independent corroborating source, regulatory filing, consumer notification, or news report has been found to confirm that an attack actually occurred. The specific data types alleged to have been accessed or exfiltrated — if any — were not specified in the attacker’s post. This incident remains an unverified, attacker-side allegation only.
Storm-1175 is a financially motivated ransomware group assessed as likely operating from a UTC+8 timezone. According to threat intelligence reporting from Microsoft and security researchers, the group began deploying a custom ransomware payload called StormEncryptor on or around August 2nd, 2026, reportedly exploiting CVE-2026-18577, an authentication-bypass vulnerability in N-able N-central RMM software. The group has previously been linked to Medusa ransomware deployments and is known for compressing its attack lifecycle to under 24 hours, using Cloudflare Tunnels for persistence, Bandizip for staging, and Rclone for data exfiltration. Storm-1175 claimed multiple victims across various sectors during August and September 2026. There is no confirmed link between these specific tactics and this particular alleged incident involving Johnson Investment Counsel.
Key Facts at a Glance
- Company or Organization: Johnson Investment Counsel
- Industry: Financial Services — Registered Investment Advisor / Wealth Management
- Location: Cincinnati, Ohio
- Incident type: Ransomware claim (unverified attacker allegation)
- Source: Ransomware.live — Storm claim, GBHackers — Storm-1175 / StormEncryptor, Femtosec — Storm Ransomware TTPs
What Should You Do?
If you are a Johnson Investment Counsel client and are concerned about this allegation, there are several precautionary steps you can take now. You can place a free fraud alert or credit freeze with each of the three major credit bureaus — Equifax, Experian, and TransUnion — to help prevent unauthorized accounts from being opened in your name. Review your credit reports at AnnualCreditReport.com for any unfamiliar accounts or activity. Monitor your financial accounts closely for suspicious transactions. If you experience signs of identity theft, report it and get a personalized recovery plan at IdentityTheft.gov.
Your Legal Rights
If your personal information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
