Ransomware victim disclosure
← All victimsAmeriprise Financial, Inc.
Claimed by Hunters International · listed 2 months ago
Status timeline
- Listed
Mar 22, 2026
- Data leaked
At a glance
- Status
- Data leaked
- Country
- United States
- Sector
- Financial Services
- Listed on leak site
- Mar 22, 2026
- Data size
- 200 GB
About the victim
AI dossier — public-source company profileAmeriprise Financial, Inc. is a publicly traded American diversified financial services company headquartered in Minneapolis, Minnesota. It provides financial planning, asset management, insurance, and annuity products to individuals and institutions, operating through a large network of financial advisors. The company manages hundreds of billions in assets and serves millions of clients across the United States.
- Industry
- Wealth Management & Financial Advisory Services
- Address
- 1099 Ameriprise Financial Center, Minneapolis, MN 55474, United States
- Employees
- 10000+
- Founded
- 1894
Attack summary
Severity: critical — The incident involves confirmed exfiltration of PII at scale from a major regulated financial services firm, combined with a large volume (200 GB) of internal SharePoint data; financial sector breaches involving client PII are subject to SEC, FINRA, and state-level regulatory obligations and carry systemic risk.Hunters International claims to have exfiltrated Salesforce records containing PII and over 200 GB of compressed SharePoint internal corporate data from Ameriprise Financial, threatening to publish the data if the company does not make contact by 25 March 2026.
Data the group says was taken
AI dossier — extracted from the leak post- Salesforce CRM records
- Personally identifiable information (PII)
- SharePoint internal corporate data
What the group claims
Salesforce records containing PII and over 200GB compressed Sharepoint internal corporate data have been compromised. This is a final warning to reach out by 25 Mar 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. | Updated: 23 Mar 2026 | Warning: FINAL WARNING
Source
Indexed 2 months agoThis page surfaces a public ransomware disclosure indexed by Darkfield. Original posts come from the operator's own leak site; we cross-check against ransomware.live, RansomLook and RansomWatch where applicable. Share this URL freely.
