AssetMark Data for Sale? An Unverified Claim, What to Do
TL;DR · the short version
A dark-web monitoring post says a threat actor on an underground forum is selling 79,885 contact records allegedly exported from the production CRM of AssetMark, a US wealth-management platform for financial advisers, for $10,000 in bitcoin. The listing allegedly includes names, job titles, emails, phone numbers, addresses, FINRA CRD and representative IDs, and lead-source notes. This is an unverified seller claim: AssetMark has not confirmed an incident, we could not find the listing or its first reporter, and the post itself notes data-quality oddities in the sample. It is separate from a confirmed AssetMark incident disclosed in June 2026, in which the company said an unauthorized user downloaded files containing customer information after using certain employee login credentials. CRD numbers are public through FINRA BrokerCheck, so their presence is not sensitive on its own; combined with emails, phone numbers and notes, they would make adviser impersonation and business email compromise easier.
A dark-web monitoring post says a threat actor on an underground forum is selling 79,885 contact records allegedly exported from the production CRM of AssetMark, a US wealth-management and technology platform for financial advisers, for $10,000 in bitcoin. This is an unverified seller claim, not a confirmed breach. AssetMark has not confirmed an incident, we could not find the original listing or who first reported it, and the monitoring post itself flags data-quality oddities in the masked sample.
Who this is for: financial advisers and their compliance teams, wealth-management firms, and security leaders who watch dark-web claims about their vendors.
Independent analysis. PlayCISO is not affiliated with AssetMark. Facts as of 13 November 2026.
Confirmed vs not yet known
Confirmed: nothing about this sale. Separately, AssetMark confirmed a May 2026 incident involving customer files (see below).
Claimed: 79,885 CRM contact records for sale at $10,000 in bitcoin, with names, job titles and status, emails (about 94%), phone numbers (about 72%), addresses, FINRA CRD and rep IDs (about 51%), and lead source, tags and notes.
Not known: whether the data is real, whether it came from AssetMark's own systems or a third party, when it was taken, and which forum carries the listing.
What the claim says
Per the monitoring post, the seller says the records were exported from AssetMark's production CRM and include adviser contact details, FINRA CRD and representative IDs, and the CRM's own lead-source fields, tags and notes. The post is careful: it calls this an unverified claim, notes AssetMark has not confirmed it, and says the masked sample shows data-quality oddities. Sellers on these forums sometimes recycle old data, combine public sources, or exaggerate; the only way to know is a statement from AssetMark or a regulator.
A separate, confirmed AssetMark incident in 2026
In a notice letter filed with the Nebraska Attorney General, AssetMark said it detected suspicious activity on certain employee login credentials, and that "on May 15, 2026, we became aware that an unauthorized user obtained access to and downloaded certain files containing customer information". It said the incident was "isolated to AssetMark and was not related to your financial advisor" and offered 24 months of credit monitoring; notices went out on 11 June 2026. ClassAction.org reports about 570,000 people affected, citing Oregon's Department of Justice list, which we did not open. That incident involved customer files; the November claim is about adviser contact records. They should not be treated as the same event.
Who AssetMark is
AssetMark describes itself as a wealth-management platform for financial advisers, headquartered in Concord, California, with over $180 billion in platform assets as of 30 June 2026, more than 10,000 advisers and over 340,000 investor households, and says it is independent and privately owned. Its Security Center already warns that "impostors often copy real names, CRD numbers, and firm details".
Useful next, if this was relevant to you
Why CRD numbers matter, and why they are not secret
FINRA describes a CRD number as "a unique number assigned to investment professionals and brokerage firms as part of their registration application with FINRA", and says CRD information is disclosable through BrokerCheck. So a CRD number is public. The danger in a list like this is the combination: a CRD number beside an adviser's direct email, mobile number and CRM notes gives a criminal everything needed for a convincing "compliance", "custodian" or "FINRA" message, or a fake request to move client money.
What advisers and firms should do this week
- Warn staff about messages that cite your CRD number, AssetMark relationship or a recent conversation, and ask them to verify by calling a number they already have.
- Lock down money movement: any change to wire or payment details needs a call-back on a known number and a second approver. Rehearse it in our invoice fraud and BEC lab; if a wire has gone, use the BEC wire recall triage.
- Use phishing-resistant MFA on email, CRM and custodian portals, and review mailbox forwarding rules.
- Ask your platform providers what data they hold about your firm and clients, and how they would tell you about an incident. Our third-party breach response checklist lists the questions.
- Know your clock: if a provider later confirms your clients' data was involved, the breach notification clock calculator turns the discovery time into deadlines.
- Do not buy or download the data to "check" it; report suspicious messages to AssetMark and your compliance team.
FAQ
Was AssetMark breached in November 2026?
Not confirmed. A threat actor claims on an underground forum to be selling 79,885 contact records allegedly exported from AssetMark's CRM, as relayed by a dark-web monitoring post. AssetMark has not confirmed an incident, its Security Center page carries no statement about it, and we could not find the original listing. Treat it as a claim until AssetMark or a regulator says otherwise.
What data is allegedly in the AssetMark listing?
According to the monitoring post, names, job titles and status, emails (about 94% of records), phone numbers (about 72%), street addresses, FINRA CRD and representative IDs (about 51%), and lead source, tags and notes. None of this has been verified, and the post notes oddities in the masked sample.
Is this the same as the AssetMark data breach from earlier in 2026?
No. In a notice filed with the Nebraska Attorney General, AssetMark said that on 15 May 2026 it became aware that an unauthorized user obtained access to and downloaded certain files containing customer information, after suspicious activity on certain employee login credentials, and offered 24 months of credit monitoring. That incident involved customer information; the November claim concerns adviser contact records from a CRM. Do not merge the two.
Is a FINRA CRD number sensitive?
Not on its own. FINRA describes a CRD number as a unique number assigned to investment professionals and firms when they register, and CRD information is disclosed publicly through BrokerCheck. The risk is in the combination: a CRD number next to an adviser's email, phone and CRM notes makes a fake compliance, custodian or FINRA message more convincing.
What should financial advisers do?
Expect targeted phishing and business email compromise that cites your CRD number or AssetMark relationship. Verify any request to change payment details, transfer funds or log in through a link by calling a number you already have, enable phishing-resistant MFA on email and custodian portals, warn staff, and report suspicious messages to AssetMark and your compliance team.
Sources
- AssetMark Security Center (no statement about the claim; read 13 Nov)
- AssetMark notice letter, Nebraska Attorney General (May 2026 incident; read)
- ClassAction.org: AssetMark, June 2026 (count cited from Oregon DOJ; read, Oregon page not opened)
- AssetMark: About us (company facts; read)
- FINRA BrokerCheck glossary and FINRA: CRD (read)
- The dark-web monitoring post relaying the forum listing (unnamed account; the listing itself was not found)
Share: #AssetMark #DataBreach #DarkWeb #FinancialServices #WealthManagement #FINRA #BEC #Cybersecurity
This article is general information, not legal or security advice.