Mariner Wealth Advisors data breach: fake IT help desk calls and a spoofed Mariner domain

Date	Event
November 21, 2025	An outsider begins posing as Mariner IT help desk staff and directing employees to a spoofed domain
November 24, 2025	Mariner detects suspicious download activity in staff cloud applications; federal law enforcement is told
After November 24, 2025	The three accounts are isolated; Mariner asks for the fake domain to be taken down
May 29, 2026	Letters begin
June 1 and 2, 2026	Reports to New Hampshire (about 35 residents) and Massachusetts (117)

What happened at Mariner Wealth Advisors?

It was a phone-led credential theft, not a network break-in. The notice to New Hampshire says the caller impersonated Mariner's IT help desk and pointed staff to a look-alike Mariner web domain, where their credentials were captured. The outsider then used them to get into the applications and copy files. The scheme was found three days later. Mariner's letter says it first saw suspicious activity on November 24, 2025, in its staff's cloud applications.

Mariner says the incident stayed inside three accounts. Its notice says the broader network and systems were not affected, operations were not disrupted, and no ransomware was deployed. The fraudulent domain was reported for takedown and is no longer online. Neither document names the cloud applications or says whether multi-factor authentication was in place.

The same playbook, a call from someone claiming to be IT support, appears in several 8-K filings this site has read. The social engineering in 8-K filings guide sets those side by side. Mariner's letters reached clients of an advisory firm, a group covered in the guide to why a CPA or advisory firm sent you a breach letter.

Were client accounts affected?

Mariner says no. The notice to New Hampshire states that all financial, investment and other client accounts are secure. What was taken were copies of files that held the information Mariner uses to service accounts. The letter says there is no evidence that any of those files has been misused. It adds that Mariner hired outside researchers to watch websites and forums for signs of the data, and they found none.

What information was exposed?

It varied by person. The notice lists name, account numbers, date of birth, and Social Security number or another government ID number. The Massachusetts record marks Social Security numbers, financial accounts and driver's licenses.

Record	People	Data it marks
Massachusetts OCABR, report 2026-892 (June 2, 2026)	117	SSNs, financial accounts, driver's licenses
New Hampshire DOJ notice (June 1, 2026)	about 35	Name, account numbers, date of birth, SSN or other government ID

Why did the letters take six months?

The documents do not give a reason beyond the file review. Mariner says the downloaded files were reviewed for personal and nonpublic information, and the letters followed. The first letters are dated May 29, 2026, 186 days after the downloads were detected. The notice letter delay guide compares that gap with other notices.

What is Mariner offering?

Twenty-four months of credit monitoring at no cost. The letter says enrollment does not affect a credit score. Questions about an account go to the client's own investment adviser. For a help desk scheme like this one, the useful step for a client is to treat any unexpected call or link about a Mariner account with suspicion, and to call the adviser back on a known number.

What the documents leave open

• The total number of people notified across all states.
• Which cloud applications were accessed.
• Who ran the help desk impersonation, and whether anyone demanded payment.