North Star Asset Management Listed by Sinobi Ransomware Group

On December 19, 2025, North Star Asset Management appeared on the leak site of the sinobi ransomware group after the firm’s internal files were allegedly exfiltrated during a ransomware attack. The Wisconsin-based SEC-registered investment advisory firm manages nearly $3 billion in client assets and provides personalized investment and retirement planning services to families across the United States.

What Public Reporting Shows

Public reporting indicates that sinobi listed North Star Asset Management on its dark-web leak portal, claiming to have stolen internal documents. Available reporting describes the firm as an independent fiduciary advisor with 11 investment professionals, nine of whom hold CFA charters and two of whom are Certified Financial Planners. The company has more than 200 years of combined experience and charges an average fee of 0.6 percent. No confirmed total of affected client records has been released, and the precise volume or sensitivity of the exfiltrated files remains unclear from current public sources.

Why This Matters for You and Your Family

When a financial advisor’s internal files are taken, the information inside often includes names, addresses, Social Security numbers, account numbers, tax documents, and correspondence tied to your investments or retirement accounts. That data can be sold or used to impersonate you, open fraudulent loans, or file fake tax returns in your name. Because North Star serves families directly, ordinary people who trusted the firm with their life savings now face the same exposure that large corporations usually worry about. If your advisor was affected, your family’s financial footprint is now sitting on a ransomware leak site.

The Doxxing and Identity-Chain Implications

Ransomware groups rarely stop at one dataset. A single leaked email or phone number from an advisor’s files can be chained to your social-media handles, children’s school records, or gaming usernames. These connections create a road map for doxxing that can escalate from identity theft to harassment or targeted scams. Credential leaks like this one frequently cascade into account takeovers on unrelated services where the same password was reused. Children’s gaming accounts are especially vulnerable because parents often share email addresses across family logins, turning one breach into a household-wide exposure.