Johnson Investment Counsel Data Breach Exposes Client Data
Johnson Investment Counsel Discloses Data Breach via Third-Party MSP
Related Entities
Threat Actors
Other
Full Report
Executive Summary
Johnson Investment Counsel, a wealth management firm, has disclosed a data breach that resulted from an unauthorized third party accessing its network through a remote-management platform operated by one of its managed service providers (MSPs). The breach, which occurred in early September 2026, led to the exfiltration of sensitive client information, including Social Security numbers. A ransomware group known as Storm has claimed responsibility on the dark web, stating it stole nearly 40 GB of data. This incident highlights the significant risks associated with the software supply chain and third-party service providers.
Threat Overview
The attack took place between the evening of September 8 and the morning of September 9, 2026. The threat actor gained access to Johnson Investment Counsel's systems by compromising a remote-management tool used by a third-party MSP. This gave the attacker a direct pathway into the firm's network. On September 18, the Storm ransomware group posted a claim on a dark web forum, asserting they had exfiltrated 39.6 GB of data and threatened to leak it. The compromised data includes highly sensitive client information like names, Social Security numbers, and health insurance details.
Technical Analysis
The primary attack vector was a supply chain compromise, specifically targeting a trusted third-party relationship (T1199 - Trusted Relationship). By compromising the MSP's remote management software, the attackers effectively inherited the trusted access that the MSP had to the client's network. This allowed them to bypass perimeter defenses. Once inside, the attackers engaged in data exfiltration (T1567 - Exfiltration Over Web Service), copying files containing sensitive client PII before their presence was detected.
Impact Assessment
For the affected clients of Johnson Investment Counsel, the exposure of their Social Security numbers and other personal data creates a high risk of identity theft, financial fraud, and targeted phishing attacks. The firm itself faces significant reputational damage, potential regulatory fines, and the cost of incident response and providing credit monitoring services to victims. This breach underscores the critical importance of third-party risk management, as an organization's security posture is only as strong as its weakest link in the supply chain.
IOCs — Directly from Articles
No specific technical IOCs such as IP addresses, domains, or file hashes were provided in the source articles.
Detection & Response
Johnson Investment Counsel detected the breach on September 9, 2026, the morning after the intrusion began. Their response includes notifying affected individuals and offering 24 months of free credit monitoring services through Epiq Privacy Solutions ID. For other organizations, detection of such an attack requires robust monitoring of all third-party connections into the network. This includes applying D3FEND's Network Traffic Analysis to look for unusual data flows or access patterns originating from MSP accounts.
Mitigation
- Third-Party Risk Management: Conduct thorough security assessments of all third-party vendors and MSPs before granting them network access. Ensure contracts include clear security requirements and right-to-audit clauses.
- Least Privilege Access: Grant third parties the minimum level of access necessary to perform their duties. Access should be restricted to specific systems and time windows.
- Network Segmentation: Segment the network to isolate systems managed by third parties from critical internal assets. This can limit the blast radius if a third-party provider is compromised.
- Egress Filtering: Implement strict egress filtering rules to block or alert on large or unusual outbound data transfers, which could indicate data exfiltration in progress. This is a core part of D3FEND's
Outbound Traffic Filtering. - Monitor Third-Party Accounts: Closely monitor all activity from third-party accounts for any behavior that deviates from established patterns.
Timeline of Events
MITRE ATT&CK Mitigations
Enforce strict network segmentation and access controls for third-party connections to limit their potential reach in case of a compromise.
Mapped D3FEND Techniques:
Continuously audit and monitor all activity from third-party accounts to detect any deviations from expected behavior.
Mapped D3FEND Techniques:
Filter Network Traffic
Implement egress traffic filtering to detect and block large-scale data exfiltration attempts.
Mapped D3FEND Techniques:
D3FEND Defensive Countermeasures
To prevent a data breach of this nature, organizations must control and monitor outbound network traffic, especially from trusted third-party connections. Configure firewalls to deny all outbound traffic by default and create explicit allow rules for only necessary business communications. For MSP connections, this means allowing traffic only to the MSP's known management IPs on specific ports. Any attempt by a compromised system to exfiltrate 39.6 GB of data to an unknown external destination, as claimed by the Storm group, should be blocked and trigger a high-priority alert. This technique is crucial for moving from detection to prevention of large-scale data theft.
The principle of least privilege is paramount when dealing with third-party access. The remote management account used by the MSP should never have had permissions to access and copy files containing client PII and SSNs. Organizations must conduct regular access reviews for all third-party accounts. Permissions should be scoped to only the specific servers and services the MSP is contracted to manage. Access to sensitive data repositories should be explicitly denied. By strictly enforcing user account permissions, the impact of an MSP compromise can be contained, preventing the attacker from accessing and exfiltrating the organization's most valuable data.
Timeline of Events
An unauthorized individual gains access to Johnson Investment Counsel's systems via a third-party MSP.
Johnson Investment Counsel discovers the security breach.
The 'Storm' ransomware group claims responsibility for the attack on a dark web forum.
The firm formally discloses the data breach in a notice to the Massachusetts Office of Consumer Affairs.
Sources & References
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Editorial Standards & Analyst Review
CyberNetSec.io uses automation to assist source monitoring, deduplication, observable extraction, and structured intelligence generation. Published analysis follows human-defined editorial standards and adds defensive context including MITRE ATT&CK, D3FEND, STIX, and Sigma where applicable. Read our editorial policy.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.