Legacy Professionals, LLP, an accounting and professional-services firm, identified suspicious activity on its network in late April 2024. The firm later determined that an unauthorized actor had taken files from its servers. Legacy's official notice states that the incident affected its systems but did not impact its clients’ systems. The firm notified appropriate governmental regulators, including the U.S. Department of Health and Human Services, and law enforcement, including the FBI.
The affected data varied by individual and could include names and contact information, Social Security numbers, tax identification numbers, driver’s-license or state-identification numbers, passport numbers, financial-account information, payment-card information, medical-treatment information, and health-insurance information. According to reported filings and breach databases, 216,752 individuals were affected. Legacy posted its notice on February 28, 2025, and mailed letters to potentially affected individuals around February 27–28, 2025.
While Legacy Professionals, LLP identified suspicious activity in April 2024, the full scope of the incident and all affected parties may not be immediately known. Additional details may emerge as investigations continue and regulatory bodies complete their reviews.