North Star Asset Management Listed by sinobi Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

North Star Asset Management was listed by the sinobi ransomware group on December 19, 2025. The listing states that internal files were exfiltrated in a ransomware attack. The number of people affected is not reported, and no further details on the volume or specific categories of data have been confirmed publicly. Incidents of this type continue to affect financial services firms that hold client records and operational documents, raising questions about data handling practices across the sector.

What happened

The incident centers on a listing posted by the sinobi group on December 19, 2025. According to the available information, the group claims to have obtained internal files from North Star Asset Management through a ransomware operation. No confirmation of the claim has been issued by the organization, and details such as the date of the intrusion, the method of access, or the scale of the data removal are not disclosed.

The group behind it: sinobi

Sinobi is a ransomware operator that has appeared in multiple public listings over recent years. The group typically uses encryption to disrupt operations and exfiltrates data before demanding payment. It maintains a leak site where it posts names of organizations it claims to have targeted, often accompanied by samples or descriptions of files. Public reporting on the group has documented similar claims against entities in finance and professional services, though each listing remains an assertion by the actor until independently verified.

Who is North Star Asset Management?

North Star Asset Management, Inc. is an independent SEC-registered investment advisory firm headquartered in Wisconsin. It manages nearly three billion dollars in assets and provides investment management and retirement planning services to families, corporations, and endowments. The firm operates with a team of eleven investment professionals and charges clients a fee of 0.6 percent. As a fiduciary, it holds records that include client financial profiles, account details, and internal operational materials.

What was likely exposed

The listing identifies only that internal files were allegedly exfiltrated. No inventory of specific documents or data fields has been released. Organizations of this type routinely maintain client account information, investment histories, tax documents, and correspondence, yet the exact contents involved in this case remain unconfirmed.

The real-world impact

Affected clients face the possibility that personal financial information could be used for targeted fraud or identity-related crimes if it reaches third parties. The organization may encounter regulatory inquiries from the SEC and state authorities given its status as a registered adviser. Both outcomes depend on the nature of the files, which has not been established.

What to do if you're exposed

Individuals who believe their information may be involved should monitor account statements and credit reports for unusual activity. They can also place fraud alerts with major credit bureaus and consider credit freezes where appropriate. Organizations in similar situations typically notify clients directly once an assessment is complete.

• Review recent statements from all financial accounts for discrepancies.
• Enable multi-factor authentication on investment and banking portals.
• Run a free exposure scan of your email address against known breach data.
• Contact North Star Asset Management directly for any official client communications.

AICompiled with AI assistance from public sources and published under our editorial standards.