Climate
Privacy
Bob Dylan
Drones
Data Centers
AI Governance
2026 Maine Senate Race
Last Update: 08/01/2026 at 1:00 PM EST
Breaches Expose Tax And Personal Data
Coverage from SecurityWeek, TechRadar, and others
Articles
78
Active Days
111
The Topic
Organizations including Ernst & Young, US Tiger Securities, and Yellow Corporation disclosed breaches involving the unauthorized access or copying of files containing highly sensitive personal, financial, tax, medical, or employment information. The strongest recurring pattern is exposure through shared, back-office, or third-party systems rather than disruption of customer-facing production services. The incidents matter because tax records, government identifiers, financial data, and health information can enable identity theft, fraud, phishing, and targeted social engineering, while the scope of affected individuals remains unclear in several cases.
First Article: 04/07/26
Latest Article: 07/26/26
Summary
- EY says attackers accessed a third-party service-management platform and downloaded client documents that may have contained tax and financial information.
- Reportedly exposed data across the incidents includes Social Security numbers, government identification, financial and payment data, medical information, health insurance details, and tax records.
- US Tiger Securities reported approximately 26,985 affected people, while stating that its customer-facing trading production environment was not breached.
- Yellow Corporation reported unauthorized access and exfiltration affecting at least 13,711 residents across Texas, Massachusetts, and Vermont, mostly former employees.
- Organizations are providing credit, identity-monitoring, restoration, fraud-alert, and credit-freeze guidance after determining the potential data exposure.
- Several disclosures do not identify the threat actor, intrusion method, affected vendor, exact records taken, or complete geographic scope.
- The incidents reinforce the exposure created when sensitive documents accumulate in shared support, virtual, or other back-office environments.
History
The update adds confirmation that the incidents are being handled with formal regulatory notifications and consumer remediation, while sharpening the operational distinction that US Tiger’s customer-facing trading environment was not breached. It also expands the impact framing by noting the risk of identity theft, fraud, and social engineering from the exposed records.
The update adds a more specific, better-substantiated breach example: EY’s third-party platform compromise with a defined intrusion window and potentially downloaded client tax documents. It also sharpens the story with concrete affected-person counts for US Tiger Securities and Yellow Corporation.
Featured
07-20-2026
Ernst & Young notified clients in the United States after a third-party platform breach exposed tax-related personal and financial information between March 28 and April 12.
07-20-2026
Ernst & Young confirmed a cyberattack in 2026 involving third-party IT service management access to tax-related client information and potential exposure.
07-17-2026
Ernst & Young disclosed a vendor-platform data breach in California after suspicious activity detected April 23, 2026 exposed client tax documents.
Timeline: 111 Days
Hover over any logo to see coverage summary, click for full article.
Additional Articles
⭐⭐⭐⭐⭐
Ernst & Young reported a March-to-April 2026 third-party platform breach that exposed client tax and financial records attached to support tickets, with at least 1,366 affected residents in multiple U.S. states.
US Tiger Securities Inc. disclosed a 2025 data breach copying files from a virtual environment affecting 26,985 people, with remediation including Experian IdentityWorks.
Yellow Corporation reported a March 27, 2025 data breach in bankruptcy proceedings, with unauthorized file access affecting Texas, Massachusetts, and Vermont residents.
Ernst & Young reported a third-party support ticket breach detected on April 23 after unauthorized access from March 28 to April 12.
Ernst & Young reported third-party support-ticket platform unauthorized access between March 28 and April 12, 2026, exposing client personal and tax-related financial data.
Ernst & Young notified customers in the United States in connection with a third-party support ticket system breach detected on April 23, with potential tax-data exposure after March 28 to April 12 access.
Ernst & Young disclosed a March 28-April 12 third-party platform breach involving client tax documents, after anomalous activity detection on April 23, 2026.
Federman & Sherwood investigates Mariner Wealth Advisors in Maine after a 2025 cloud application breach exposed client PII, including Social Security numbers.
Dohman, Akerlund and Eddy LLC and the Maine Attorney General issued health data breach claim instructions with a September 10 deadline for $50 or documented reimbursement up to $5,000.
US Tiger Securities began notifying affected individuals in 2026 after a July 2025 cyber incident in a virtual back office exposed sensitive IDs and medical data.
Ernst & Young disclosed a March 28 to April 12, 2026 third-party helpdesk platform breach, detected April 23, with client notifications and California AG filings in July 2026.
Ernst & Young disclosed a third-party support ticket breach detected on April 23, 2026 that potentially exposed client tax and personal financial data.
⭐⭐⭐
Hallisey & D'Agostino, LLP reported a 2025 network intrusion and potential personal-data exposure affecting 16,683 individuals in the United States, with Maine and Rhode Island notifications.
M&T Bank notified customers in April 2026 about a data breach tied to a Gelinas & Ward LLP incident from August 2025 that may have exposed Massachusetts residents and other customers.
Hogan Transports reported a breach affecting consumer Social Security, government ID, and financial account data after unauthorized access from Oct. 25 to Nov. 29, 2025.
Young & Company LLC reported 2025 unauthorized access to employee email accounts, exposing Social Security numbers, and issued Maine and Massachusetts notifications in 2026.
Perma-Chink Systems Inc. disclosed a May 7, 2026 network intrusion in Maine after suspected copying of files containing names and Social Security numbers.
Easterly Government Properties Inc. disclosed June 15, 2026 notification to Massachusetts regulators after an EY tax-services security incident exposed sensitive personal data.
Wallace Saunders disclosed a May 2026 unauthorized access incident affecting files on a Kansas network, with notification to Massachusetts regulators on July 15, 2026.
Edelson Lechtzin LLP is investigating a TransGlobal Insurance Agency data breach discovered on February 24, 2026, involving exposure of sensitive personal information.
On July 20, 2026, Marian Clarke filed a class action in New York alleging Ernst & Young LLP failed to safeguard tax-related personally identifying information after an alleged hacking incident.
Mariner Wealth Advisors disclosed a November 2025 cloud application breach to the Maine attorney general on a Monday filing, affecting 8,995 customers.
Federman & Sherwood began investigating a ScrogginsGrear email account breach after a Maine Attorney General notification about potential exposure of Social Security and health identifiers.
Ernst and Young investigated a third-party IT support ticket system compromise that exposed client tax and financial information between March 28 and April 12, 2026.
Sorenson, Ransom & Ferguson, LLP reported an email account intrusion to the Maine Attorney General, discovered March 30, 2026, with notifications starting April 21, 2026.
TD Bank Data Breach Exposes Customer Social Security Numbers and Account Details in Insider Incident
TD Bank reported mid-June 2026 notice to Massachusetts regulators after an employee accessed U.S. customer records between January 7 and 30.
Mullinax Automotive notified the Maine Attorney General of suspicious activity after unauthorized system access may have exposed sensitive personal information.
Hallisey & D'Agostino, LLP notified the Maine Attorney General in 2026 about a 2025 unauthorized network-access incident that may have exposed sensitive personal data.
Federman & Sherwood is investigating a CHASI email-system hacking incident reported to affect about 501 people after an HHS notification on April 21, 2026.
Auto Auction of New England Inc. informed the Attorney General of Maine in April 2026 after a February 2026 unauthorized access incident involving personal-information files.
Federman & Sherwood investigates Universal Pure after an August 2024 breach notice to Maine exposes names with Social Security numbers and triggers credit monitoring via TransUnion.
Federman & Sherwood investigated a Law Offices of Alan M. Cohen & Associates LLC data breach after a Maine Attorney General notification on April 23, 2026.
Federman & Sherwood investigates Transport Workers Union Local 100 after a Maine Attorney General notification about unauthorized system access exposing Social Security and health identifiers.
Federman & Sherwood is investigating a GrayRobinson, P.A. data breach after a Maine Attorney General notice about potential unauthorized file access in 2025.
Federman & Sherwood investigated a Maine-filed breach notice involving Rodenburg Law Firm after unauthorized network access around August 26, 2025.
Federman & Sherwood is investigating TransGlobal Insurance Agency, Inc. after a February 2026 cyberattack reported to the Maine Attorney General may have exposed sensitive personal data.
Federman & Sherwood is investigating the First Harvest Federal Credit Union breach, reported to the Maine Attorney General after suspected employee email account access in January 2026.
Federman & Sherwood is investigating the Young & Company data breach after potential exposure of Social Security numbers was reported to the Attorney General of Maine.
Federman & Sherwood and Hogan Transports investigated a reported November 2025 data breach after unauthorized access exposed Social Security and financial data.
Beacon Mutual Insurance Company reported a January 2026 data breach to Maine authorities after unauthorized access exposed names and Social Security numbers for about 607 residents.
Federman & Sherwood investigates VacPartsWarehouse.com after unauthorized access to an e-commerce platform potentially exposed payment card data for Maine residents.
Federman & Sherwood investigates NCCER after Quilin reportedly exfiltrated data from NCCER systems, with Maine Attorney General notification and credit monitoring offered.
Federman & Sherwood is investigating the Cardinal Services data breach after Cardinal Services notified the Maine Attorney General about unauthorized access events in 2025.
Federman & Sherwood is investigating a Charles P. Elliott, P.C. unauthorized-access data breach reported to the Attorney General of Maine, with potential impacts identified May 14, 2026.
Federman & Sherwood began investigating Joyal Capital Management, LLC after a Maine Attorney General data-breach notice tied to unauthorized access around January 27, 2026.
Federman & Sherwood is investigating Blue Teal Holdings, LLC after a Maine-reported unauthorized-access incident on or about October 13, 2025, with review completed by May 11, 2026.
Federman & Sherwood investigated a Lockton employee data breach reported to the California Attorney General after inadvert vendor file sharing on April 29, 2026.
Federman & Sherwood is investigating the Ultrahuman data breach after a March 27, 2026 unauthorized access incident was reported to the California Attorney General.
MasTec disclosed a 2025 data breach to the Attorney General of Maine after unauthorized third-party network access affected sensitive personal information.
Federman & Sherwood is investigating the E.W. Scripps Company data breach reported to the Maine Attorney General, after unauthorized access to employee emails exposed Social Security numbers in 2026.
Federman & Sherwood began investigating a Greenbaum Rowe Smith & Davis LLP data breach reported to U.S. HHS after a network-server hacking incident affected about 12,801 individuals.
Federman & Sherwood began investigating the Jones Mayer data breach after Jones Mayer reported the incident to the California Attorney General on June 22, 2026.
Federman & Sherwood investigates the MCBS, LLC data breach in Augusta, Georgia, after potential exposure of sensitive personal and protected health information between Sept. 22-26, 2025.
Federman & Sherwood investigates Reframe after unauthorized access and download of uploaded user personal information reported to the California Attorney General.
Federman & Sherwood investigated Quest Health Solutions after an alleged ransomware attack on July 7, 2026, focusing on possible patient data exposure.
Federman & Sherwood is investigating the Connecticut Wealth Management data breach reported to the Vermont Attorney General, involving possible exposure of Vermont residents financial account and card information.
Murphy Law Firm is investigating a Hogan Transportation Companies data breach detected around November 29, 2025, with potential exposure of thousands of individuals' sensitive information.
US Tiger Securities Inc. disclosed a July 2025 data breach, completed review in April 2026, and began May 15, 2026 notices to 26,985 affected US individuals.
Interstate Management Company reported an external hacking incident to the Maine Attorney General on May 26, 2026, affecting 22,743 people at The Westin San Diego Bayview.
On October 9, 2025, Law Offices of Alan M. Cohen & Associates LLC reported unauthorized viewing and copying of files between Oct. 1 and Oct. 9 and offered 24 months of credit monitoring via Cyberscout.
Hogan Transports reported a late-2025 unauthorized access event that may have exposed Maine residents personal and financial identifiers, with notifications starting May 8, 2026.
Manzil Investment Advisors, LLC reported a 2026 data breach affecting about two New Hampshire residents, with notifications starting around June 5, 2026.
DocketWise disclosed a Maine Attorney General data breach notice in 2026 after October 2025 third-party credential cloning accessed law firm client data.
Federman & Sherwood opened an investigation on April 7, 2026 into a suspected David Evans Enterprises data breach reported to the Maine Attorney General after late-February unauthorized access.
Kloeckner Metals Corporation disclosed a Maine-filed 2026 breach where unauthorized network access copied files containing names and Social Security numbers, with notifications mailed around April 10, 2026.
Federman & Sherwood is investigating a TruView BSI, LLC data breach after a Texas Attorney General notification on April 10, 2026 reported about 702 residents affected.
Federman & Sherwood is investigating the Berger & Williams data breach reported to Maine after unauthorized access to an employee email account was discovered in April 2026.
Federman & Sherwood investigates Catalanatto & Barnes CPAs after a February 2026 data breach report to the Nebraska Attorney General.
Ernst & Young disclosed a third-party IT support platform breach affecting tax and personal financial data between March 28 and April 12, 2026.
Federman & Sherwood investigated Bank3 after a Maine Attorney General notification over unauthorized access in July-August 2025 and Maine resident data exposure.
Federman & Sherwood investigates a Retail Therapy LLC data breach after a Maine Attorney General notification about unauthorized system access in late 2025.
Federman & Sherwood investigated a 2025-to-2026 external system breach at Markowitz, Ringel, Trusty & Hartog, P.A. after a Maine Attorney General notification.
Federman & Sherwood began investigating a Revolution Dancewear data breach after Maine Attorney General notification, covering unauthorized access from March 16 to April 3, 2025.
Federman & Sherwood is investigating a Boyd Bros. Transportation data breach reported to the Nebraska Attorney General after potential unauthorized access beginning May 12, 2026.
Federman & Sherwood is investigating an OnTrac cybersecurity incident where unauthorized file access may have exposed personal information between March 20 and March 22, 2026.