Accounting Firm Data Breach 2026: 45 Firms in State AG Filings, and Breaches Start in Tax Season While Notices Do Not

Search results for this query offer checklists from vendors, single-firm stories and class action pages, and a claim that CPA firm breaches rose 80 percent over eight years, which on the checklist page we read links back to a 2020 Tax Adviser article. None tests the question every firm asks: is filing season really when you get hit? We matched every 2025 and 2026 notice on the California, Indiana, Massachusetts, Texas, Vermont and Washington lists against a written name rule, then tested the months against all other filers.

The latest accounting firm breach filings

A row means a firm filed a breach notice with a state regulator. It is not a finding that the firm did anything wrong, and we state only what the filing says.

Is there a tax-season spike in accounting firm breaches?

Not reliably in the filings. The IRS opened the 2026 season on January 26 with an April 15 deadline and an automatic six-month extension, so those are the marks to look for. In 2026, 16 of 42 firms first filed in February to April, which looks like a spring bump. In 2025 the same months held 9 of 44, and the peak came in May and June. Two years pull in opposite directions, so we looked further back.

We widened the sample to every matched firm-year since 2017 on the California, Washington, Indiana (2021 on), Massachusetts (2025 on, notice dates only) and Texas lists, using all other filers on those lists as the baseline. That baseline matters because breach notices vary by month for everyone. The left panel shows when notices arrive, and the right panel shows when the breach is said to have begun. The dark line is all filers, and red bars mark February to April.

The two panels disagree, and the gap is the finding. Notices are flat against the baseline. Start dates are not: 41.2% fall in February to April, about 1.5 times the expected share. August to October, the extension season, runs the other way at 11.5% against 23.2%. So there is no autumn peak to match the spring one. Half of the 54 firm-years that began in February to April reached notice within 104 days, and 47 of them were noticed after that year’s April 15, which is why a list sorted by notice date hides it.

Chance probability is an exact one-sided binomial test against the all-filer share, with February to April chosen in advance from the IRS calendar. Start dates are as stated by filers, and many filers give a date range; we use the earliest date on the record.

The recent years are weaker on their own: 37.3% against 26.2% for notices filed in 2025 and 2026, with a probability of 0.05, on only 51 firm-years. So the pattern is well supported over the decade and only suggestive for this year. We also ran the same test on other groups as a check. If the spike were an artifact of how lists record dates, it should show up there too, and it does not.

These data do not show why the breaches begin then. The start date could reflect attackers timing the season, more client data moving through portals and email in those months, or earlier intrusions that are only detected in spring. The lists cannot separate those.

How many accounting firm breaches were reported, and how big?

Firm counts are level on 2025. On the four lists with a 2025 file, January 1 to October 31 (October 13 for Washington) went from 44 firms to 42, or 37 to 34 using only the name rule with no LLP reading. All filers on those lists moved from 3,888 notices to 3,920.

Most stated totals are small. The median of 26 stated totals is 1,547 people, and 22 of 26 are under 5,000. 15 more firms list only one state’s residents, and 4 list no count. Two filings stand apart: Mercadien, P.C. CPAs at 488,893 on Indiana’s list, and Forrestall CPAs LLC at 60,843. A client’s filing confirms the first: SR Bancorp told the SEC that files on Mercadien’s servers, which it uses for internal audit work, included bank customer data, so the exposure reaches customers of the firm’s clients.

Filing-season months shaded. *November through Nov. 5 only. People sums the largest figure each firm stated and places it in the month of first notice. 13 of the 31 firms with a stated breach date describe a breach that began before 2026, so they do not appear in the last column.

How did the breaches happen?

Only 10 of 45 firms state a cause we could read, partly because Massachusetts letters leave the nature of the incident out. The named causes are specific to this trade: tax software appears in three, and two of those describe fraudulent or suspicious returns. Platt, Miller & Jacobs, CPAs, LLP says an attacker used an employee’s Outlook account to send phishing emails to clients. The sample is small, so read this as examples, not rates.

Massachusetts also records what each notice covered: 100% of the 26 accounting firm notices there list Social Security numbers and 62% list financial accounts. The IRS warns that criminals want client data “in order to file fraudulent tax returns for refunds”.

How long until notice, against the FTC’s 30 days?

The FTC clock runs from discovery, and it covers a notice to the FTC, not to consumers or states. These lists do not show FTC filings, and our FTC Safeguards Rule breach notification report found no public list of them, so this chart cannot test compliance. It shows the only related clocks available. Each dot is a filing; the triangle is the median for all filers on that list. Texas is the one list here with a discovery date for these firms, with a median of 34.5 days from discovery to the AG’s posting, which can trail the filing.

From stated breach date, Indiana’s median for these firms is 147 days against 133 for all filers, and California’s is 85 against 145. 13 of 31 firms with a stated date describe a breach that began in an earlier calendar year. For comparison across sectors, see how long companies take to report data breaches.

WISP checklist: what the rule and the IRS require

16 CFR 314.2(h)(2)(viii) names “an accountant or other tax preparation service that is in the business of completing income tax returns” as a financial institution. IRS Publication 5708 (Rev. 8-2024) says: “A requirement of the Safeguards Rule is implementing and maintaining a WISP. Your WISP must be written and accessible.” Publication 4557 (Rev. 6-2024) adds: “Failure to do so may result in an FTC investigation.” Firms holding data on fewer than 5,000 consumers skip four provisions, marked below, and nothing else. Tick what is in place; the count updates as you go. Stated breach totals are not the same as customers held, so 22 of 26 firms under 5,000 affected does not tell you who is exempt.

0 of 15 items ready

16 CFR Part 314 text current to 2026-10-29 on eCFR. Exemptions from 314.6. This summarizes the rule and is not legal advice.

What this means for MSPs

1. Do not relax monitoring in the busy months. 41% of stated start dates fall in February to April. Freeze risky changes if the firm asks, but keep detection running, and schedule a mailbox and sign-in review for the week after April 15.
2. Put the tax suite inside your security scope. Three notices name tax software or tax filing access, including one that describes a fraudulent return. Multi-factor on the tax suite falls under 314.4(c)(5), so check whether it sits inside your identity tooling. If not, ask for an admin view, or get it in writing that the firm owns it.
3. Run the weekly EFIN and PTIN check as a ticket. Publication 4557 tells firms to check e-File Application and PTIN account totals weekly. You cannot log in for them, but you can raise the reminder weekly in season and record the answer, which then serves as evidence for the program.
4. Offer to be the Qualified Individual, with care. 314.4(a) allows a service provider in that role, but the firm keeps responsibility and must name a senior overseer. Price it as a role with a written scope, not a free add-on.
5. Build the WISP from your own data. Publication 5708 asks for an inventory with device location and data stored, a list of authorized users and access levels, and incident steps. RMM and identity exports cover most of that, which makes this a fast, concrete first project for a new CPA client.
6. Write the first-hour list. The IRS says speed lets it block fraudulent returns. Put the stakeholder liaison, state tax agencies, FBI, police and the FTC threshold on one page, and log the discovery date immediately, because the 30 days run from it. 17 of 26 firms stating a total reach 500 people.
7. Plan for clients of your client. Mercadien’s filing reached a bank’s SEC disclosure. Firms that do audit or payroll work hold other companies’ employee and customer data, and Blair C Diaz CPA, PC tells recipients it performs payroll services for their employer. Map that data separately, since it changes who must be told.

Every 2026 accounting firm notice in this report

45 firms, newest first. Click a heading to sort. Each list link goes to the primary record: a Massachusetts or California letter or record where one exists, otherwise the state list itself. Texas and the newer Vermont rows live in the state’s own table, so search the firm name there.

Frequently asked questions

Which accounting firms had a data breach in 2026?

As of November 5, 2026, 45 accounting, CPA and tax firms appear on six state lists. The newest are Michael J. Berger and Co., CPA LLP (Oct 21), Mercadien, P.C. CPAs (Oct 20), Frazer LLP (Oct 17), emc CPAs LLC (Oct 15). The largest stated totals are Mercadien, P.C. CPAs (488,893) and Forrestall CPAs LLC (60,843). A listing is a notice, not a finding of fault.

How many accounting firm data breaches happened in 2026?

We count 45 firms and 74 notices from January 1 to November 5, 2026. On the four lists with a 2025 file, the same window went from 44 firms to 42, so the count is level. This is a floor, since names without an accounting term are missed and most states publish no list.

Do accounting firm data breaches spike in tax season?

The notices do not: 24.4% of notices are filed in February to April, against 25.4% for all filers. The breaches do: since 2017, 41.2% of stated start dates at these firms fall in those months, against 27.1% for all filers. Notice arrives a median 104 days later, which hides the pattern.

Is a WISP required for accounting firms?

Yes for firms that complete income tax returns. 16 CFR 314.2 names them as financial institutions, and IRS Publication 5708 says a requirement of the Safeguards Rule is implementing and maintaining a written information security plan, regardless of size. Publication 4557 warns that failure may result in an FTC investigation.

Do accounting firms have to report a data breach to the FTC?

Yes, when unencrypted customer information of at least 500 consumers is acquired without authorization: as soon as possible and no later than 30 days after discovery, under 16 CFR 314.4(j). That sits on top of state notices and the IRS request to contact your stakeholder liaison.

What should an accounting firm do first after a breach?

The IRS data theft page lists contacting the local IRS stakeholder liaison, the FBI, the Secret Service if directed, and local police, reporting to the FTC at 500 or more people, and contacting states where the firm prepares returns. It stresses that quick reports let the IRS block fraudulent returns.

Methodology

References

1. Washington Attorney General, Data Breach Notifications (data.wa.gov). Accessed November 2026.
2. California Attorney General, Search Data Security Breaches. Accessed November 2026.
3. Indiana Attorney General, Security Breaches, year-to-date reports. Accessed November 2026.
4. Massachusetts OCABR, 2026 Data Breach Notification Report. Accessed November 2026.
5. Massachusetts OCABR, 2025 Data Breach Notification Report. Accessed November 2026.
6. Texas Attorney General, Data Security Breach Reports. Accessed November 2026.
7. Vermont Attorney General, Security Breach Notices. Accessed November 2026.
8. 16 CFR Part 314, Safeguards Rule (eCFR). Accessed November 2026.
9. IRS Publication 5708, Creating a Written Information Security Plan. Accessed November 2026.
10. IRS Publication 4557, Safeguarding Taxpayer Data. Accessed November 2026.
11. IRS, Data Theft Information for Tax Professionals. Accessed November 2026.
12. IRS, IR-2026-12, January 26, 2026, filing season opens. Accessed November 2026.
13. IRS, When to file. Accessed November 2026.
14. SR Bancorp Form 8-K, Item 8.01, July 2026. Accessed November 2026.
15. Maine Attorney General, Data Security Breaches. Accessed November 2026.