Hightower knocks ‘baseless’ lawsuit as cyberattacks spread across RIAs

Amid a wave of cyberattacks targeting large RIAs and wealth management firms, Hightower refutes a lawsuit from a former employee over an alleged data breach that exposed personal information of more than 130,000 individuals. 

Plaintiff Elliott Adams, identified in the complaint as a former employee of Hightower, filed a class-action suit in Illinois federal court that claims Hightower failed to “properly secure and safeguard” client information in a cyberattack that began January 8. According to a notification filed with the Maine attorney general, the attack impacted 131,483 individuals and Hightower’s written notice of the data breach was sent to customers on March 23.

“We are aware of the lawsuit filed regarding a recent incident. The claims in the complaint are baseless, as are many of the allegations. Hightower takes its obligations very seriously and will continue to do so,” a spokesperson for Hightower wrote to InvestmentNews. 

Adams is seeking $5 million in damages in his suit against Hightower, which follows a similar class-action suit against fellow mega-RIA Mercer Advisors. In that suit, Mercer allegedly refused to pay a ransom to cybercriminal group ShinyHunters, who then exposed client data on the dark web. 

Other large RIAs hit with data breaches in cyberattacks this year include Edelman Financial Engines, Beacon Pointe Advisors, CW Advisors, Betterment, Pathstone Family Office, and EP Wealth. In a statement sent to InvestmentNews in March, Beacon Pointe confirmed a recent data breach impacted less than 0.5% of its clients. Michael Cocanower, CEO of RIA cybersecurity provider itSynergy, says the recent attacks vary in their magnitude of exposed client data implications. 

“You have some companies that have been attacked, didn't pay the ransom and all of their information was released, and there are other companies that have put out public statements saying we were the victim of an attack, but it only affected .5% of our customers,” Cocanower told InvestmentNews. “I interpret that as showing the efficacy of some of their internal cybersecurity risk management controls, whereas some of the others that were more widely impacted, seems like maybe there's something that they need to revisit there.”

Wealth management giants Cetera and Ameriprise have been the latest defendants named in lawsuits regarding cyberattacks and alleged data breaches. California resident Jennifer Collier filed her class-action suit against Cetera on March 30. New Jersey resident Pamela Caffrey, a former Ameriprise client, filed her suit dated March 27, claiming Ameriprise failed to properly notify clients of a data breach perpetrated by ShinyHunters that occured on or around March 22.

A spokesperson for Cetera said the firm does not comment on legal matters. A company spokesperson for Ameriprise said the firm is confident Caffrey’s personal identifiable information was not compromised in the recent cyberattack.

“We recently experienced an incident involving unauthorized access to certain stored data and files. We blocked the unauthorized access, and outside forensic experts have confirmed this. Importantly, there has been no disruption to business operations, and clients and advisors have secure access to our systems and sites. In any instance when personally identifiable information (PII) is impacted, we would provide notice in keeping with our regulatory responsibilities. We’re confident that the PII of the individual who filed the suit was not impacted,” said the Ameriprise spokesperson.  

Under the SEC’s updated Reg S-P rules, RIAs must notify clients within 30 days if sensitive data is exposed in a cyberattack. The updated requirements went into effect for large RIAs ($1.5 billion AUM and above) on December 3, 2025, while smaller RIAs below that asset threshold must comply by June 3.

“Is there truly elevated activity in the RIA space, or do the RIAs simply have more regulatory requirements to disclose breaches than other industries and therefore we hear about that more than we hear about breaches in other industries,” said Cocanower. “My guess is that breaches are actually taking place all over the place, it's just a lot of organizations don't have a regulatory obligation to disclose that and so they don't.”