Andrew Davidson & Co., Inc. Listed by frag Ransomware Group

On November 14, 2024, Andrew Davidson & Co., Inc., a financial services firm specializing in risk analytics and consulting for the mortgage-backed and asset-backed securities industry, appeared on the leak site of the frag Ransomware Group. The listing states that the company suffered a ransomware attack in which internal files were exfiltrated. The disclosure indicates that the attackers obtained contact details of customers and employees, financial statements of the company, and insurance certificates. The exact number of people affected remains unknown.

Details from the Leak Site

The frag leak site posting, archived on ransomware.live, states that the group claims successful extraction of the three categories of documents listed above. It does not specify the volume of records, the date of initial compromise, or whether any decryption key is being offered. The notification language is typical of ransomware operators who move stolen data to their public shaming portal after the victim declines to pay. No formal breach notification from Andrew Davidson & Co., Inc. has surfaced yet, so the only What's Publicly Reported are those published by the threat actor itself.

Why This Matters for You and Your Family

If you or any member of your household has done business with Andrew Davidson & Co., worked there, or had your contact information stored in their systems, your personal details may now sit in a criminal archive. Contact details of customers and employees often include names, physical addresses, phone numbers, and email accounts. When combined with financial statements or insurance certificates, this information gives criminals enough to attempt identity theft, loan fraud, or targeted phishing. Even if you are not a direct customer, family members listed on shared insurance documents or joint financial records could be exposed.

The Doxxing and Identity-Chain Risk

Stolen contact data rarely stays isolated. Attackers and subsequent buyers routinely cross-reference it against other breaches to build complete identity chains. A phone number from this leak can link to your children’s gaming accounts, your spouse’s employer portal, or an old utility bill. Once those connections are mapped, doxxing escalates quickly: public profiles are scraped, addresses are published, and extortion demands may follow. Credential leaks of this type frequently cascade into account takeovers across unrelated services where the same email and password were reused.

Frag Ransomware Group Track Record

Public reporting attributes frag to a relatively new ransomware operation that emerged in 2024. The group follows a double-extortion model: it encrypts victim networks and simultaneously exfiltrates documents before threatening to publish them. Notable prior victims include other mid-sized professional services and financial-adjacent firms. The typical playbook begins with phishing or exploitation of remote desktop services for initial access, followed by rapid data exfiltration and then publication on their leak site when ransom talks fail. The frag site currently lists several victims in the financial and consulting sectors, suggesting the group is deliberately targeting organizations whose data contains personal and corporate financial records.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real-world identity so you can see exactly what this claimed breach connects to.
• Rotate any password you ever used at Andrew Davidson & Co. or related financial portals and enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information surfaces you learn within hours instead of months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often become entry points when credential leaks like this one occur.
• Let remediation specialists handle data-broker takedown requests and follow-up correspondence so you do not have to chase every site yourself.

The incident underscores how quickly financial-service data can move from a corporate server to a public ransomware portal. One short-term breach can create long-term exposure for you and your family if the connections are not mapped and closed. Start your DoxxScan trial today; its continuous monitoring, AI-powered identity-chain mapping, hands-on remediation by specialists, and household coverage give ordinary families the same defensive tools once reserved for large organizations.