Andrew Davidson & Co., Inc. Listed by frag Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target financial-services firms that sit at the center of capital markets, seeking leverage through stolen internal records rather than simple system disruption. In this environment, even specialized consultancies that advise on complex securities can become high-value targets because of the sensitive client and corporate data they routinely handle.

On November 14, 2024, the ransomware group known as frag listed Andrew Davidson & Co., Inc. on its leak site, claiming to have exfiltrated internal files in a ransomware attack. The number of people affected remains unknown, and independent confirmation of the full scope has not been publicly detailed. The listing itself is a claim by the group; what follows is a factual account of the information that has been reported.

Breaking down the breach

Public reporting indicates that Andrew Davidson & Co., Inc. was listed by the frag ransomware group on November 14, 2024. The group asserted that its operators had successfully extracted internal files during a ransomware attack. No further technical details—such as the initial access vector, the duration of unauthorized access, encryption of systems, or any ransom demand—have been disclosed in the available record. The scale of the incident, including the total volume of data taken or the number of individuals whose information may have been involved, is listed as unknown. At this stage the only concrete assertions come from the group’s own leak-site posting, which has not been independently verified in the public domain.

The group behind it: frag

Frag operates as a ransomware group that follows the now-common double-extortion model: data is first stolen, then systems may be encrypted, and the stolen material is threatened with public release if payment is not made. Like other actors in this space, frag maintains a leak site where it posts victim names and sample files to increase pressure. The group’s public activity has centered on claiming successful exfiltration of corporate documents and personal contact information. In the case of Andrew Davidson & Co., Inc., frag claims its team extracted specific categories of documents; those claims should be treated as unverified assertions until corroborated by the company or independent investigators. No additional statements from frag about this particular victim beyond the listing and the listed document types have been reported.

About Andrew Davidson & Co., Inc.

Andrew Davidson & Co., Inc. is a provider of risk analytics and consulting services focused on the mortgage-backed securities (MBS) and asset-backed securities (ABS) markets. Firms of this type advise institutional clients—investors, issuers, and servicers—on valuation, risk modeling, and portfolio analysis for complex structured-finance products. Because their work sits at the intersection of capital markets and credit risk, such organizations typically maintain detailed client relationships, proprietary models, and internal financial records. A breach involving a specialist consultancy in this sector can therefore raise concerns not only for the firm itself but also for the counterparties and investors who rely on its analysis.

What data was at risk

According to the group’s own claims, the material taken included contact details of customers and employees, financial statements of the company, and insurance certificates. The broader description of the incident refers to “internal files exfiltrated in a ransomware attack.” Exact file counts, the full range of document types, and whether any additional categories of data were involved have not been confirmed. Organizations that provide risk analytics to the MBS and ABS markets commonly hold client contact information, contractual records, internal financial reports, and supporting compliance or insurance documentation; however, the precise contents of any archive associated with this incident remain unconfirmed beyond the categories frag has listed.

The real-world impact

For individuals whose contact details may have been included, the primary risks are targeted phishing, social-engineering attempts, and unwanted solicitations that exploit the appearance of legitimacy. Employees could face similar exposure, potentially including attempts to impersonate colleagues or vendors. For the company, the claimed exposure of financial statements and insurance certificates could supply competitors or other parties with insight into its financial position and risk-transfer arrangements, while any client contact data could undermine trust in the firm’s ability to safeguard sensitive relationships. Because the number of affected people is unknown and the full data set has not been independently described, the concrete extent of these risks cannot yet be quantified. The incident also illustrates the broader operational and reputational pressure that ransomware listings place on specialized financial-services firms, regardless of whether systems were encrypted or a ransom was paid.

Were you affected?

If you have done business with Andrew Davidson & Co., Inc. or are a current or former employee, treat any unexpected communications that reference the firm with caution. Monitor financial and email accounts for unusual activity, enable multi-factor authentication where available, and consider placing fraud alerts with the major credit bureaus if you believe personal details may have been involved. Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets. Public detail on this incident remains limited; any official notifications from the company itself should be regarded as the authoritative source for next steps.

AICompiled with AI assistance from public sources and published under our editorial standards.