Conrad Capital Management Listed by dragonforce Ransomware Group

On March 18, 2026, Conrad Capital Management, a registered investment advisory firm founded in 1998, appeared on the leak site of the dragonforce ransomware group. The attackers claim to have exfiltrated internal files containing customers’ personal information and financial data. The number of individuals affected remains unknown.

What's Publicly Reported from Reporting

Public reporting indicates that Conrad Capital Management provides personalized financial advice, retirement planning, and portfolio management to individuals and institutions across the United States. The firm’s fiduciary role means it holds detailed records on clients, including names, addresses, Social Security numbers, account numbers, investment holdings, and correspondence. Available reporting describes the data as having been taken during a ransomware incident and later published on the group’s leak site when the firm did not meet the attackers’ demands. No official statement from Conrad Capital Management confirming the breach timeline or exact scope has been widely published as of this writing.

Why This Matters for You and Your Family

When an investment advisor’s systems are breached, the information exposed is among the most sensitive you can possess. Financial records and personal identifiers allow criminals to file fraudulent tax returns, open accounts in your name, or impersonate you with banks and brokers. For families, the risk extends beyond the primary account holder: spouses, dependents, and shared addresses are often linked in the same files. A single leak can trigger months or years of fraudulent activity that damages credit, triggers IRS scrutiny, and creates lasting stress. Because the breach involves financial data rather than just email addresses, the potential for real-world fraud is elevated.

The Doxxing and Identity-Chain Implications

Stolen financial documents rarely stay isolated. Attackers combine them with other leaked records to build complete identity profiles. A customer list from an advisory firm can be cross-referenced with previous breaches to reveal home addresses, phone numbers, children’s names, and even gaming usernames tied to family email accounts. These connections create doxxing chains that lead to harassment, targeted phishing, or physical threats. Credential leaks of this nature frequently cascade into account takeovers on brokerage platforms, email services, and online gaming networks used by you or your children.

Dragonforce Group’s Known Track Record

Public reporting attributes the attack to the dragonforce ransomware group. The group emerged in recent years and has targeted organizations across multiple sectors. Their typical playbook involves initial access through common vulnerabilities or phishing, followed by data exfiltration, encryption of systems, and publication of samples on their leak site when victims refuse to pay. Notable prior victims have included companies in healthcare, manufacturing, and professional services, according to available ransomware trackers. The group’s extortion style relies on the threat of releasing sensitive client or employee data rather than solely on system downtime.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, investment accounts, and real-world identity, with cleanup handled by the service.
• Rotate every password used at Conrad Capital Management anywhere it is reused, then enable 2FA through an authenticator app rather than text messages.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your data is caught in hours, not months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that can chain back to the same breached records.
• Let the remediation specialists perform hands-on takedown requests across data brokers and leak sites on your behalf.

The incident underscores that financial advisory relationships once viewed as private can quickly become public liabilities when ransomware operators strike. Protecting yourself and your family now requires more than changing a password; it demands ongoing visibility into where your information surfaces and rapid, expert intervention when it does. DoxxScan by GalaxyWarden delivers that visibility through continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping that connects online handles to real identities, and hands-on remediation by specialists who also safeguard household and children’s gaming accounts vulnerable to the same credential cascades. Starting protective measures promptly limits the window criminals have to exploit this claimed breach.