Alan Gordon, CPA, an accounting firm, notified Vermont regulators in August 2026 that client data was exposed in a breach. Exposed data includes Social Security numbers, government ID numbers, and financial account and card information. Anyone who used this firm’s accounting services should monitor credit reports and consider a credit freeze immediately.
| Company | Alan Gordon, CPA |
|---|---|
| Industry | Finance |
| Data Types Exposed | Social Security Numbers, Government ID Numbers, Financial Account Codes, Credit and Debit Account Information |
| People Affected | Not Publicly Disclosed |
| Attack Method | Unspecified/Unauthorized Access |
| Regulators Notified | Vermont Attorney General |
What Happened in the Alan Gordon, CPA Data Breach?
Alan Gordon, CPA, an accounting firm that handles sensitive financial and tax records for its clients, recently confirmed a data breach. The firm filed a formal notification with the Vermont Attorney General in August 2026. This filing revealed that unauthorized parties may have accessed personal client information stored on the firm’s systems.
According to the notification, the exposed data includes Social Security numbers, government ID numbers, and financial account codes. Credit and debit account information was also involved. As a result, this incident falls into the category of breaches that expose highly sensitive financial identifiers, not just contact details.
The exact discovery date has not been publicly disclosed. However, the notification itself became public in August 2026. Because the firm works with tax and financial records, the scope of exposed data is especially concerning for affected clients.
At this stage, the firm has not released a detailed public account of the attack method. Therefore, it remains unclear whether the incident involved ransomware, a phishing compromise, or another form of unauthorized access. Regardless of method, the firm’s own filing confirms that personal data was accessed.
Following discovery, Alan Gordon, CPA appears to have undertaken a review of the incident before notifying regulators. This step typically involves determining which individuals were affected and which data categories were involved. The firm’s notification to Vermont regulators reflects the outcome of that process.
Who was affected?
The breach likely affects individuals who used Alan Gordon, CPA for tax preparation, accounting, or related financial services. Because accounting firms typically retain years of client financial records, the affected population may include both current and former clients.
The exact number of affected individuals has not been publicly disclosed. In addition, the firm has not specified whether employees, in addition to clients, were impacted. Given the nature of accounting services, it is possible that family members listed on joint tax returns could also be affected.
The geographic scope of the breach also remains unclear. However, because the notification was filed with Vermont’s Attorney General, at least some affected individuals likely reside in Vermont. It is possible that clients in other states were also affected, since accounting firms often serve clients beyond their home state.
What Information Was Potentially Exposed?
The categories of exposed data are especially sensitive because they include core identifiers used in financial and tax fraud. This is not a breach limited to names or email addresses. Instead, it involves the kind of data that criminals actively seek out.
- Social Security numbers
- Government ID numbers
- Financial account codes
- Credit and debit account information
Because Social Security numbers were involved, affected individuals face a heightened risk of identity theft. Criminals can use these numbers to open new credit accounts, file fraudulent tax returns, or apply for loans in someone else’s name. This risk can persist for years after a breach, since Social Security numbers cannot be changed easily.
Similarly, exposed financial account and payment card information could lead to direct financial fraud. For example, criminals could attempt unauthorized purchases or withdrawals. In addition, government ID numbers could be used to create fraudulent identification documents, which can compound the harm from identity theft.
What is the company doing?
In response to the breach, Alan Gordon, CPA filed a formal notification with state regulators. This step is a standard requirement under most state data breach laws. As a result, affected individuals in Vermont were formally notified of the incident.
Specifically, the firm filed notice with the Vermont Attorney General. This filing confirms the categories of data involved and establishes a public record of the breach. Beyond this filing, the firm has not publicly detailed additional remediation steps, such as system upgrades or third-party forensic reviews.
It is common for firms in this position to offer credit monitoring or identity protection services to affected individuals. However, the source notification does not confirm whether Alan Gordon, CPA has made such an offer. Affected individuals should review any direct notification letter they receive for details on available protections.
What Should Affected Individuals Do?
Monitor Your Credit Reports
Affected individuals should request copies of their credit reports from all three major credit bureaus. This allows you to check for unfamiliar accounts or inquiries. You can request free reports through AnnualCreditReport.com.
Because this breach involved Social Security numbers, ongoing monitoring is especially important. In addition, checking your credit report regularly over the next year can help you catch fraudulent activity early. Early detection often makes resolving fraud easier.
Consider a Fraud Alert or Credit Freeze
Given that Social Security numbers and financial account data were exposed, placing a fraud alert or credit freeze is a strong protective step. A fraud alert requires lenders to verify your identity before opening new credit. A credit freeze goes further by blocking most new credit applications entirely.
To place a freeze, you must contact each of the three credit bureaus separately. Although this requires some effort, it significantly reduces the risk that someone can open accounts using your stolen information. You can lift the freeze temporarily whenever you need to apply for credit yourself.
Watch for Phishing and Scam Attempts
After a breach like this, scammers often use exposed information to craft convincing phishing emails or phone calls. As a result, affected individuals should be cautious of unexpected messages asking for personal information. This is especially true for messages claiming to be from the IRS, banks, or the accounting firm itself.
Never click links or share personal details in response to unsolicited messages. Instead, verify any request by contacting the organization directly through a known phone number or website. This simple habit can prevent many follow-up scams tied to data breaches.
Protect Against Tax-Related Identity Theft
Because government ID numbers and Social Security numbers were exposed, affected individuals should be alert to signs of tax fraud. For example, a rejected tax return because one was already filed in your name can indicate fraud. Similarly, unexpected IRS notices should be taken seriously.
Consider requesting an Identity Protection PIN from the IRS if you have not already done so. This PIN adds another layer of verification before anyone, including you, can file a tax return under your Social Security number. This step can meaningfully reduce your risk of tax-related identity theft.
Consult a Data Breach Attorney
Given the sensitivity of the exposed data, affected individuals may want to speak with a data breach attorney. An attorney can help you understand whether you qualify for compensation. In addition, many offer free case evaluations with no upfront cost.
Because deadlines for filing legal claims vary by state, acting sooner rather than later is wise. Consulting an attorney early can help preserve your legal options. This is particularly important if you notice signs of fraud tied to this breach.
More Information
View the public data breach notification listing from Vermont Attorney General