Michael J. Berger and Co., CPA LLP notified the Vermont Attorney General in October 2026 that a data breach exposed clients’ Social Security numbers, financial account codes, and credit or debit account information. The exact number of people affected and the discovery date have not been publicly disclosed. Affected individuals should place a credit freeze or fraud alert and monitor financial accounts closely for suspicious activity.
| Company | Michael J. Berger and Co., CPA LLP |
|---|---|
| Industry | Finance |
| Data Types Exposed | Social Security Numbers, Financial Account Codes, Credit and Debit Account Information |
| People Affected | Not Publicly Disclosed |
| Attack Method | Unspecified/Unauthorized Access |
| Regulators Notified | Delaware Attorney General, Vermont Attorney General |
Were you affected by this breach?
You may be owed compensation.
Data breach victims can recover money for identity-theft losses, out-of-pocket costs, wasted time, and the ongoing risk of fraud — usually with no upfront cost, and no fee unless you win.
Check if you qualify — free reviewWhat Happened in the Michael J. Berger and Co., CPA LLP Data Breach?
Michael J. Berger and Co., CPA LLP, an accounting and tax services firm, has disclosed a data breach affecting client information. The firm filed a formal notification with the Vermont Attorney General in October 2026. This filing confirmed that unauthorized parties may have accessed sensitive personal and financial data held by the firm.
The notification does not state a specific discovery date for the breach. As a result, the exact timeline of when the intrusion occurred, or how long it lasted, has not been publicly disclosed. What is known is that the firm determined personal information was involved and moved to notify affected individuals and regulators as required by law.
Because Michael J. Berger and Co. handles tax preparation and accounting services, the firm likely stores highly sensitive financial records for its clients. This makes any unauthorized access particularly concerning. The firm’s notification suggests an internal review took place to identify which data categories were affected before notifying state regulators. However, further forensic details have not been made public.
Who was affected?
The breach appears to primarily affect clients of Michael J. Berger and Co., CPA LLP who entrusted the firm with their financial and tax information. Given the nature of accounting services, affected individuals may include current and former clients whose records were stored electronically or in firm systems.
The exact number of people affected has not been publicly disclosed. In addition, the notification does not specify whether employees of the firm were also impacted. Because tax preparation often involves multi-year recordkeeping, individuals who worked with this firm even several years ago could potentially be included among those notified.
What Information Was Potentially Exposed?
According to the breach notification filed with the Vermont Attorney General, several categories of sensitive personal and financial data were involved in this incident. These categories are directly tied to the type of information accounting firms typically retain for tax and financial services.
- Social Security Numbers
- Financial Account Codes
- Credit and Debit Account Information
The exposure of Social Security numbers creates a significant risk of identity theft. With this information, criminals could potentially open new credit accounts, file fraudulent tax returns, or apply for loans in a victim’s name. Because Social Security numbers do not change, this risk can persist for years after a breach occurs.
Additionally, the exposure of financial account codes and credit or debit account information raises the risk of direct financial fraud. Criminals could attempt unauthorized charges or transfers using this data. As a result, affected individuals should watch their bank and card statements closely for any unfamiliar activity in the months following this disclosure.
What is the company doing?
Michael J. Berger and Co., CPA LLP responded to the incident by notifying the Vermont Attorney General, as required under state breach notification law. This filing indicates the firm reviewed the incident and identified the categories of data involved before reaching out to regulators and affected individuals.
In addition to the Vermont filing, the firm has also filed formal notifications with the Delaware Attorney General. This pattern of regulatory notification suggests the firm’s response has extended across multiple jurisdictions where affected clients reside. The notification filings are a standard step required when sensitive personal data is compromised, and they typically precede direct notice letters to the individuals involved.
Beyond these filings, specific details about remediation steps, such as whether credit monitoring services were offered, have not been publicly disclosed. Affected individuals should review any notification letter they receive directly from the firm for specific guidance and available protections.
What Should Affected Individuals Do?
Monitor Your Credit Reports
Affected individuals should request a free copy of their credit report from each of the three major credit bureaus. Reviewing these reports regularly can help you catch unauthorized accounts or inquiries early, before they cause lasting financial damage.
Because Social Security numbers were involved in this breach, ongoing credit monitoring is especially important. You can stagger requests from Equifax, Experian, and TransUnion throughout the year to maintain near-continuous visibility into your credit file at no cost.
Consider a Fraud Alert or Credit Freeze
Given that Social Security numbers and financial account details were exposed, placing a fraud alert or credit freeze is a strong protective step. A fraud alert requires lenders to verify your identity before issuing new credit, while a credit freeze blocks new accounts from being opened in your name entirely.
Both options are free to set up and can be requested directly through each credit bureau. As a result, taking this step soon after receiving a notification letter can significantly reduce the chances of identity thieves opening fraudulent accounts using your information.
Watch for Phishing and Scam Attempts
Because breach notifications often prompt follow-up scams, affected individuals should be cautious of unexpected emails, calls, or texts claiming to be from the firm or related financial institutions. Scammers frequently use breach news to trick people into revealing further information.
If you receive a suspicious message, avoid clicking links or providing personal details. Instead, contact the organization directly using a verified phone number or website to confirm whether the communication is legitimate.
Review Financial and Tax Accounts Closely
Since financial account codes and credit or debit account information were involved, affected individuals should carefully review bank and card statements for unfamiliar transactions. This is particularly important given the firm’s role in tax and accounting services.
In addition, consider monitoring for signs of tax-related fraud, such as unexpected IRS notices about returns you did not file. If anything appears unusual, report it promptly to your financial institution and the IRS.
Consult a Data Breach Attorney
If you received a notification letter from Michael J. Berger and Co., CPA LLP, it may be worth speaking with a data breach attorney. An attorney can help you understand whether you qualify for compensation or participation in a class action related to this incident.
Many attorneys offer free consultations for breach victims. This means you can explore your legal options without any upfront cost, while receiving guidance tailored to your specific situation.
Get a Free Case Review
Tell us how this breach affected you. A data breach attorney will review your situation at no cost and with no obligation — it takes about two minutes.
More Information
Official data breach notification report (PDF) from Delaware Attorney General
View the public data breach notification listing from Vermont Attorney General