Platt, Miller & Jacobs, CPAs, LLP, an accounting firm based in Santa Cruz, California, discovered on March 11, 2026, that an unauthorized user had gained access to an employee’s Microsoft Outlook email account the previous day. The threat actor used this access to send phishing emails to some clients. The firm reported that its tax return and file storage systems were not accessed.
An investigation found that sensitive personal information in emails was accessible to the unauthorized user. The exposed data includes dates of birth, Social Security numbers, addresses, email addresses, phone numbers, financial account information, driver’s license numbers, state identification numbers, and credit/debit card numbers. While the firm reported the breach to the Massachusetts Attorney General on September 28, 2026, affecting two Massachusetts residents, a reliable nationwide affected count has not been identified.
Platt, Miller & Jacobs stated that it had no information indicating misuse of the accessed information. The company has implemented additional security measures, employee training, and tighter access controls. The firm also offered 18 months of Kroll identity-monitoring services to affected individuals. Further details regarding the full scope of the breach and any additional affected individuals may emerge as investigations continue, and formal notifications can sometimes be delayed.