Colina Financial Advisors Listed by incransom Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
Colina Financial Advisors was listed by the incransom ransomware group on June 03, 2026, with an undisclosed number of people affected after internal files were exfiltrated. Individuals should check whether their information was exposed and take protective steps.
On June 3, 2026, the ransomware group incransom listed Colina Financial Advisors on its leak site, claiming to have obtained internal files during a ransomware incident. The number of individuals affected remains unknown, and the precise volume or contents of any exfiltrated material have not been independently confirmed.
The listing places a Bahamas-based wealth-management firm into a pattern of targeted operations against organizations that hold sensitive financial and personal records. Such incidents can expose clients to identity misuse or fraud even when the full scope of data is not publicly detailed.
Breaking down the breach
Public reporting states that internal files were exfiltrated in a ransomware attack against Colina Financial Advisors. No confirmed figure for the number of records or individuals involved has been released. The date the data were first accessed or encrypted is not disclosed in available information.
The group’s leak-site posting constitutes a claim rather than a verified inventory. Independent confirmation of the data’s authenticity or completeness has not been provided by the organization or by investigators.
The group behind it: incransom
Incransom is a ransomware operation that has appeared in multiple public listings involving corporate victims. Like similar groups, it typically gains initial access through remote services or stolen credentials, moves laterally inside networks, and then exfiltrates data before deploying encryption.
The group maintains a leak site where it posts names of organizations and samples of claimed material. Attribution of any specific incident rests on the group’s own statements unless corroborated by the victim or by law-enforcement findings.
About Colina Financial Advisors
Colina Financial Advisors Limited is an independent wealth-management and investment-advisory firm headquartered in Nassau, The Bahamas. Established in 1997, it operates as the investment arm of Colina Holdings Ltd. and provides services to both individual and institutional clients.
Firms of this type routinely collect and store account details, investment instructions, and supporting identification documents. A compromise at such an organization therefore touches records that are both financially sensitive and subject to regulatory protections in the jurisdiction where the firm is based.
The information in question
Available information indicates that internal files were removed during the incident. Specific categories of data, such as client names, account numbers, or identification documents, have not been confirmed in public statements from the organization.
Because the exact contents remain undisclosed, it is not possible to state with certainty which records were involved. Organizations in this sector commonly hold client profiles and transaction histories, yet any assumption about the present case would be speculative.
Why it matters
Financial-advisory records can be used for account takeover attempts, tax-related fraud, or targeted phishing. Even without a confirmed count of affected individuals, the nature of the data held by such firms means that any confirmed exposure carries ongoing monitoring obligations for those clients.
For the organization, the incident adds regulatory, reputational, and operational costs. Clients may face questions about the security of their information regardless of whether the full dataset is later published.
What to do if you're exposed
Individuals who believe their information may be involved should review account statements for unusual activity, enable multi-factor authentication on financial portals, and consider placing fraud alerts with credit bureaus where available. Monitoring bank and investment accounts regularly remains the most direct step.
Readers can also run a free exposure scan of their email address against known breach data sets to check for prior appearances of their information in other incidents.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
belpointeasset.com \ belpointe.com Listed by incransom Ransomware Grouphttps://sibillacapital.com/ Listed by incransom Ransomware Grouphttps://www.wilkemgroup.com/ Listed by incransom Ransomware Groupsubmissionfinance.com Listed by incransom Ransomware GroupLatest breaches
Publicly posted by incransom — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.