Herman & Chamow, CPAs Data Breach Notice (Indiana Attorney General): What Was Exposed & What To Do

A small number of people whose information was held by Herman & Chamow, CPAs now face the practical question of whether their personal details were taken in a cyber incident and what that could mean for identity theft or fraud risk. Public notice confirms the firm alerted Indiana residents after a breach, so those individuals have a concrete reason to check notices, monitor accounts, and tighten everyday security even when the scale is limited.

According to a filing reported to the Indiana Attorney General on June 03, 2026, Herman & Chamow, CPAs notified affected Indiana residents of a data breach. The same filing places the incident itself on November 03, 2025. Five people are reported as affected, and the notification describes exposure of personal information. Further technical detail in the public record is limited.

What happened

Herman & Chamow, CPAs submitted a data-breach notice that was reported to the Indiana Attorney General on June 03, 2026. That filing states the underlying incident occurred on November 03, 2025. The organization identified five people as affected and described the exposed material as personal information, consistent with the breach notification language used in the filing.

Public detail does not describe how the intrusion or access occurred, what systems were involved, how long unauthorized access lasted, or whether data was exfiltrated, viewed, or only placed at risk. No ransom demand, downtime figure, or forensic narrative appears in the provided facts. The confirmed points remain the incident date, the later regulatory reporting date, the count of five affected individuals, and the characterization of the data as personal information.

How a breach like this happens

Incidents affecting professional services firms often begin with commonplace entry points rather than exotic techniques. Typical paths include a phishing message that harvests credentials, a compromised remote-access account, malware on a workstation that reaches shared files, or misconfigured cloud storage that leaves documents reachable without proper authentication. Once an attacker has a foothold, they may search for client lists, tax worksheets, identity documents, or archived correspondence because those materials are concentrated and valuable for fraud.

In many cases the organization discovers the event weeks or months later through unusual login alerts, endpoint detection, a client complaint, or routine audit work. Containment then involves resetting access, isolating systems, and determining which records were touched. None of these general patterns is confirmed as the method in this specific matter; they are background only, because the public filing does not attribute a technique or name a threat group.

Herman & Chamow, CPAs and its sector

Herman & Chamow, CPAs is an accounting practice. Firms of this type routinely handle material that clients must supply to complete tax returns, financial statements, audits, and advisory work. That commonly includes names, addresses, Social Security numbers or other government identifiers, bank and investment details, income and employment records, and business financials. Even a tightly scoped engagement can leave a durable digital trail of highly sensitive personal and financial data.

A breach at a CPA firm is consequential because the data is both identity-rich and finance-rich. Fraudsters can misuse it for tax refund fraud, new-account opening, targeted phishing that references real filing details, or social-engineering attacks against banks and family members. The small reported count of five affected people does not remove the seriousness for those individuals; it does indicate the disclosed impact was narrow rather than a mass consumer event.

What was likely exposed

The breach notification, as reflected in the Indiana Attorney General reporting summary, names personal information as the exposed data type. Exact field-by-field contents are not itemized in the facts provided, so it is not established which specific elements—such as full Social Security numbers, dates of birth, account numbers, or tax documents—were involved for each person.

Organizations in this sector typically hold combinations of identity and financial records needed for accounting and tax work. Because the public notice does not confirm a precise inventory beyond “personal information,” readers should treat any richer list as unconfirmed and rely on the individual notice they may have received from the firm for their own case.

The real-world impact

For the five people identified, the main risks are ordinary but persistent: fraudulent tax filings, attempts to open credit in their name, account takeover if financial identifiers were present, and convincing scam messages that cite real personal details. Harm is not automatic; much depends on what was actually taken, how quickly monitoring begins, and whether credentials or reusable identity numbers were included. Still, personal information from an accounting relationship is attractive raw material for long-tail fraud that can surface months after the incident date.

For the firm, consequences can include notification costs, regulatory scrutiny under state breach laws, client trust questions, and the operational burden of investigation and remediation. The facts do not state negligence, financial loss amounts, or regulatory penalties; those points remain outside the disclosed record. The gap between the November 03, 2025 incident date and the June 03, 2026 reporting date simply underscores that discovery, assessment, and formal notice can take time, which is common and not, by itself, proof of fault.

What to do if you're exposed

If you believe you are one of the people notified, or if you were a client around the incident timeframe, treat the situation as a prompt for steady hygiene rather than panic. Practical first steps include:

• Read any official notice from Herman & Chamow, CPAs carefully and keep a copy; it should state what the firm believes was involved in your case.
• Place a free fraud alert or consider a credit freeze with the major credit bureaus if identity data may have been included.
• Monitor tax transcripts, bank and credit-card statements, and credit reports for unfamiliar activity, especially new accounts or changed addresses.
• Use unique passwords and multi-factor authentication on email and financial accounts so a single leaked detail is harder to chain into full takeover.
• Be skeptical of unexpected calls or messages that reference the breach or demand immediate payment or personal data; verify through known official channels.
• Run a free exposure scan of your email to check whether your information has already surfaced in known breach data sets, then remediate any reused passwords you find.

Public detail on this incident remains limited to the Indiana filing’s core points: an event dated November 03, 2025, reported June 03, 2026, five people affected, and personal information named in the notification. Anyone directly contacted should follow the guidance in their letter and consider speaking with a trusted advisor if they see signs of misuse.

AICompiled with AI assistance from public sources and published under our editorial standards.