The Burney Company data breach

What we know

The Burney Company operates within the wealth management and financial advisory sector, providing comprehensive investment management, financial planning, and fiduciary services to individuals, families, and institutional clients. Because of the nature of their business, firms of this caliber routinely collect, process, and retain vast quantities of highly confidential financial and personal records. This includes detailed portfolio holdings, tax documents, estate planning materials, and core identity verification records necessary to execute transactions and manage multi-generational wealth. The accumulation of such sensitive financial intelligence makes these organizations high-value targets for sophisticated cybercriminal syndicates seeking to exploit vulnerabilities for financial gain. In 2025, a security incident affecting The Burney Company was formally reported to the Massachusetts Attorney General's Office. While the precise vectors and internal mechanics of the intrusion are subject to ongoing forensic investigation, breaches within the financial services sector typically involve unauthorized access to enterprise networks, compromised employee credentials, or vulnerabilities within third-party vendor platforms used for portfolio accounting and client relationship management. Such incidents often grant malicious actors prolonged, undetected access to internal databases housing confidential client files, exposing the structural weaknesses in an organization's digital perimeter. The exposure resulting from this security failure compromises a dangerous combination of personally identifiable information and core financial data. Victims face severe, long-term risks, including the immediate threat of account takeover, unauthorized wire transfers, and fraudulent investment transactions. Furthermore, the inclusion of core identifiers such as Social Security numbers and dates of birth exposes affected individuals to pervasive identity theft, fraudulent tax filings, and the unauthorized opening of new credit lines in their names. In the wealth management sphere, compromised financial profiles can also be leveraged by bad actors to execute targeted spear-phishing campaigns designed to deceive clients into releasing additional funds or credentials. As a financial institution handling sensitive consumer and client data, The Burney Company is subject to stringent federal and state regulatory frameworks, including the Gramm-Leach-Bliley Act (GLBA) and the Massachusetts Data Privacy Security Act. These laws mandate rigorous administrative, technical, and physical safeguards to protect nonpublic personal information from unauthorized access and disclosure. The occurrence of a data breach of this magnitude serves as a strong indicator that the institution may have failed to implement or maintain adequate cybersecurity measures, potentially violating statutory duties of care and failing to meet the industry standards required of modern fiduciary and wealth management firms. For clients and consumers who have received a data breach notification letter from The Burney Company, this document serves as official acknowledgement that their private financial and personal records were compromised due to corporate security inadequacies. Under modern legal standards, the receipt of such a notification provides the necessary legal standing to participate in a class action lawsuit aimed at holding the company accountable. Affected individuals do not need to prove that actual financial loss has occurred to seek legal redress; the increased risk of future identity theft and the forced expenditure of time and money on credit monitoring services constitute actionable harm. Our firm is actively investigating potential class action claims on a contingency fee basis, meaning affected clients pay nothing out of pocket and legal fees are recovered only if a successful recovery is secured.

See every breach reported in Massachusetts or read what to do after a ransomware attack.