Sprague and Jackson, based in Ithaca, NY and providing accounting services, experienced an external system breach attributed to the Qilin ransomware group. The breach occurred on September 22, 2025, and was discovered the same day. However, consumers were not notified until May 26, 2026, approximately eight months later. The Qilin ransomware group claimed responsibility for the attack on October 15-16, 2025.
Compromised data types include name, address, and employment-related information. The total number of affected individuals has not been disclosed, and specific types of information such as SSN, medical, or financial data were not explicitly confirmed in public filings. Sprague and Jackson offered 12 months of TransUnion credit monitoring and identity protection to affected individuals.
Details about data breaches can emerge over time, and notification processes may be delayed.