Ferguson Wellman Listed by losttrust Ransomware Group

On September 26, 2023, investment advisory firm Ferguson Wellman appeared on the leak site operated by the losttrust ransomware group. The firm, which manages $8.2 billion for 913 clients, is claimed to have had internal files exfiltrated during a ransomware attack. Anyone whose financial records, account statements, tax documents, or personal identifiers were held by the firm may now face heightened risk of identity theft and targeted fraud.

Details in the Leak-Site Listing

The losttrust leak site states that Ferguson Wellman, a privately owned investment advisory firm based in Oregon, suffered a ransomware incident in which internal files were successfully exfiltrated. The listing does not quantify the number of records taken, list specific data types beyond “internal files,” or disclose the exact date of initial compromise. It does note that the firm and its division West Bearing Investments design and manage customized portfolios for individuals, families, foundations, endowments, and corporate retirement plans. The disclosure indicates the data is now publicly listed for anyone who visits the extortion portal, a standard tactic used to pressure victims into payment.

Why This Matters for You and Your Family

If you or any member of your family has been a client of Ferguson Wellman or West Bearing Investments, your sensitive financial and personal information may be in the hands of criminals. Investment firms like this one routinely store Social Security numbers, dates of birth, bank routing details, retirement account numbers, trust documents, and correspondence that can be used to impersonate you or your relatives. Even if the leak-site listing does not detail every record type, the exposure of internal files from an advisory firm that manages billions in client assets creates real-world risk of account takeovers, tax fraud, and spear-phishing campaigns aimed at your household.

Doxxing and Identity-Chain Implications

Stolen internal files from wealth-management firms frequently contain spreadsheets that link client names to addresses, phone numbers, email accounts, and sometimes advisor notes. Attackers can combine this information with data from previous breaches to build detailed identity chains. A single leaked email or phone number can lead to compromise of linked brokerage logins, credit accounts, or even children’s educational and gaming profiles that share the same parental contact details. Once criminals map these connections, they can launch convincing social-engineering attacks or sell the package on underground forums, turning one breach into long-term exposure for every member of the household.

Losttrust Group Track Record

Public reporting attributes losttrust with emerging in early 2023 as a ransomware and extortion operation. The group typically gains initial access through phishing or exploitation of remote desktop services, exfiltrates data before deploying encryption, and then posts samples on its leak site when victims refuse to pay. Notable prior targets have included manufacturing, legal, and professional-services organizations. The group’s playbook relies on public shaming and incremental data dumps rather than immediate mass publication, giving victims a short window to respond before broader exposure. The exact success rate and full victim list remain unclear, but the pattern shows consistent focus on mid-sized firms that hold sensitive client data.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, addresses, and real-world identity so you can see exactly what chains back to the Ferguson Wellman breach.
• Rotate any password you ever used at Ferguson Wellman or West Bearing Investments and enable 2FA through an authenticator app everywhere that same password appears.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information surfaces you learn within hours rather than months.
• Cover the entire household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often become entry points when parental financial data is exposed.
• Let DoxxScan remediation specialists handle data-broker takedown requests and related exposure tied to this incident so you do not have to chase every site yourself.

The Ferguson Wellman listing is a reminder that even long-established advisory firms can become targets, and the data they hold travels farther and faster than most families expect. Starting with clear visibility into your personal exposure chain is the most practical defense. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts vulnerable to credential-stuffing attacks that cascade from incidents like this one.