Johnson Investment Counsel Breach Compromises Social Security Numbers

Johnson Investment Counsel, a Cincinnati-based wealth management firm, disclosed a data breach involving unauthorized access through a third-party managed service provider

The breach was disclosed to the Massachusetts Office of Consumer Affairs and Business Regulation on Oct. 8, 2026.

An unauthorized person gained access to certain Johnson Investment Counsel systems through a remote-management platform operated by the firm's managed service provider. The unauthorized access occurred between late in the evening on Sept. 8, 2026, and the early morning hours of Sept. 9, 2026.

Johnson Investment Counsel discovered the breach on Sept. 9, 2026.

During the window of access, the intruder acquired copies of certain files from the company's systems. A subsequent review of those files determined they contained personal information, including names, Social Security numbers, health insurance information and information saved to work personal drives.

Notably, on Sept. 18, 2026, a ransomware group known as Storm claimed responsibility for the attack on a dark web forum. The group stated it had obtained 39.6 GB of the organization's data and intended to publish it within 14 to 15 days.

Johnson Investment Counsel's response to the breach

Johnson Investment Counsel is offering affected individuals 24 months of free credit monitoring through Epiq Privacy Solutions ID.

Affected individuals can enroll by visiting Epiq Privacy Solutions ID and entering the activation code provided in their notification letter. Those with questions about the enrollment process can call Epiq directly at 866-675-2006.

For other questions about the breach, the company has directed affected individuals to contact Rick Bryant at 513-389-2753, Monday through Friday, 8:30 a.m. to 5:00 p.m. Eastern Time, excluding major U.S. holidays.