Third Avenue Management Listed by metaencryptor Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Third Avenue Management, a New York City-based asset manager, was listed by the metaencryptor ransomware group on April 08, 2025. Public reporting indicates that internal files were exfiltrated in a ransomware attack, though the number of people affected remains unknown and further details about the incident are limited.

The listing itself constitutes a claim by the group rather than independent confirmation of the full scope or impact. For an organisation that manages investments in publicly traded securities, any unauthorised access to internal material raises practical concerns about the confidentiality of operational and client-related information.

What happened

According to available public information, Third Avenue Management was named on a leak site associated with the metaencryptor ransomware group on April 08, 2025. The reported summary states that internal files were exfiltrated as part of a ransomware attack. No confirmed figures have been released for the volume of data taken, the precise date the intrusion began, the initial access method, or whether systems were encrypted in addition to the data theft. The number of individuals potentially affected is listed as unknown. Public detail beyond the group’s claim and the characterisation of the material as internal files remains limited.

Who is metaencryptor?

Metaencryptor is a ransomware operation that has appeared in public reporting as a group that combines data encryption with the exfiltration of files, a tactic commonly described as double extortion. Groups of this type typically gain access to a network, move laterally, steal selected data, and then deploy ransomware while threatening to publish the stolen material if a ransom is not paid. Victims are frequently listed on dedicated leak sites as a form of pressure. Metaencryptor has been associated with attacks on organisations across multiple sectors; its listings are claims made by the group and are not automatically verified by independent investigators. In this case, the listing of Third Avenue Management should be treated as an unverified assertion by the actors unless further confirmation emerges.

Third Avenue Management and its sector

Third Avenue Management is described as a New York City-based asset manager that follows a disciplined, value-oriented, and asset-based approach to investing in publicly traded securities. Public figures place its revenue at approximately $48 million. Asset-management firms of this kind typically oversee portfolios for institutional and individual clients, maintain records of holdings, transactions, valuations, and compliance documentation, and handle sensitive commercial and personal financial information. Because such firms sit at the intersection of capital markets and client wealth, a breach can affect not only the organisation’s own operations but also the privacy and financial security of the people and entities whose assets or data it manages. The sector is subject to regulatory expectations around data protection and fiduciary duty, which makes any confirmed or claimed compromise consequential for both reputation and ongoing client relationships.

What was likely exposed

The only data type named in public reporting is “internal files” said to have been exfiltrated in the ransomware attack. Exact contents, file counts, or categories beyond that description have not been disclosed. Organisations in the asset-management sector commonly hold materials such as investment research, portfolio positions, client correspondence, account documentation, employee records, contracts, and internal financial or compliance files. Whether any of those specific categories were among the material allegedly taken from Third Avenue Management is unconfirmed. Readers should treat the precise nature of the exposed data as unknown until more detailed verification becomes available.

What's at stake

For individuals whose information may have been among the internal files, the principal risks include potential misuse of personal or financial details for fraud, identity theft, or targeted phishing. Even if only corporate operational data was taken, that material can still reveal business strategies, counterparty relationships, or employee information that could be leveraged in further social-engineering attempts. For the firm itself, the incident carries operational disruption, possible regulatory scrutiny, reputational damage, and the cost of investigation and remediation. Because the number of people affected is unknown and the full inventory of files has not been published, the concrete scale of harm cannot yet be quantified. The absence of Reported Details does not eliminate the need for caution among anyone who has had a professional or client relationship with the organisation.

What to do if you're exposed

Anyone who believes their data may have been involved should begin by monitoring financial accounts and credit reports for unusual activity and by treating unsolicited communications that reference the firm or investment matters with heightened scepticism. Changing passwords on related accounts, enabling multi-factor authentication where available, and placing fraud alerts with credit bureaus are practical first steps. Organisations and individuals can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets. If additional official notifications or confirmations are issued by Third Avenue Management or by regulators, those should be followed carefully. Remaining calm and methodical is more effective than reacting to unverified claims.

AICompiled with AI assistance from public sources and published under our editorial standards.