Three wealth firms let $380,000 in deadlines expire in silence; 92,038 client records go public

DUBAI, UAE - EntSun -- Three financial firms whose systems exposed client data have let payment deadlines pass in silence, and proof rows are going out to press today.

- AssetMark — 79,885-row production CRM export (taken 5 Nov, 00:28 UTC): 75,435 emails, 57,602 phones, 40,943 CRD numbers. USD 300,000 demanded; deadline 9 Nov, 21:00 UTC. No public statement six days on.

- Orion Advisor Solutions — 11,959 addresses from hub.orion.com and social.orionadvisor.com, six WordPress administrators included. USD 50,000; deadline 10 Nov, ~13:00 UTC. Silent.

- RM Holding / GuestA (Dubai) — 194 records: 125 owners with building and unit, 106 DEWA account numbers, 75 telco, 20 gas, 7 cooling accounts, plus 69 CMS/Bayut leads. USD 30,000; deadline Saturday, 19:35 UTC — still running, no reply.

It is not sophistication. It is hygiene:

- GuestA encrypts its owner register AES-GCM for anonymous visitors, then prints the passphrase in the page: "guesta123". Cracked offline in under a minute; the same password variant opened the marketing CMS and its lead lists.

More on EntSun News

• Las Vegas Comedy Headliner Don Barnhart Returns to Pechanga Thanksgiving Weekend Nov. 27–28
• Kitchen Table Economics: An Invitation to Think Differently
• Who Won New York Fashion Week SS27? Tommy Hilfiger Led the Media as Tory Burch Won the Critics
• Win a $5,000 VIP Family Experience at the 100th Thanksgiving Day Parade in New York City
• CB Stuffer Announces Private Sale to Secure Future of Brand Growth

- AssetMark stores raw dollar amounts in the job-title field — 748 rows, 214 of them "$1,000,000" — and leaves a row reading "QA test record created by this run" in production.

- In all 40,943 populated rows, crd and rep_id are the same number — a duplicated schema field.

- Orion's set is current to the hour (latest registration 6 Nov, 20:24 UTC) and includes staff accounts, not just prospects.

"Nobody is disputing the data; nobody is answering," NorthUNC said. "AssetMark's advisors and their clients are still being told nothing. Saturday is Dubai's last quiet minute."

Proof supplied to press: three GuestA owners with unit and DEWA number (T1 U1103 / 2044642026; Dubai Opera U1607 / 345414144; U2401 / 2048276130) and four AssetMark CRD/rep rows. A 50-row sample within the hour, encrypted to the journalist's key.

Datasets map to cases AM-2611-A, ORN-2611-A and RM-2611-A. Bitcoin only: bc1qux2xku37c434cavje9df9qqre0v2evrhveeddk.

About NorthUNC: independent research group publishing unpatched client-data exposure. northunc@proton.me; PGP F3CA A427 D08B C93C C2ED C12D 001A 2CA5 D819 521C.

Address: bc1qux2xku37c434cavje9df9qqre0v2evrhveeddk