Mather & Co CPAs LLC Data Breach Notice (Indiana Attorney General): What Was Exposed & What To Do

Mather & Co CPAs LLC notified Indiana residents of a data breach in a filing reported to the Indiana Attorney General on June 29, 2026. According to that notice, the incident itself occurred on February 26, 2026, and 17 people were affected. The notification describes the exposed material as personal information; further technical detail about how the incident unfolded has not been made public in the available record.

For a small number of individuals whose information was held by an accounting firm, even a limited breach can create lasting practical risk. What is known so far is modest in scale yet still consequential for those named in the notice, because personal data held by CPA practices is often sensitive and reusable by fraudsters.

Breaking down the breach

Public reporting rests on the Indiana Attorney General filing. Mather & Co CPAs LLC submitted a data-breach notice that places the incident on February 26, 2026, and the regulatory report date on June 29, 2026. The filing states that 17 people were affected and that personal information was involved. No public breakdown of attack method, systems touched, duration of unauthorized access, or forensic findings appears in the disclosed summary. Whether the firm discovered the event internally, through a vendor, or via external notice is likewise unconfirmed in the available record.

The gap between the stated incident date and the later Attorney General filing is several months. Such intervals are common when organizations investigate, determine notification obligations, and prepare letters, but the notice itself does not explain the timeline. Scale is explicitly small: seventeen individuals. That figure does not expand the known facts into a larger population or additional states; only the Indiana filing and the stated count are on record.

How a breach like this happens

Incidents that lead to notices of this kind typically begin with unauthorized access to systems or files that store client or employee records. Common pathways, described here only as general background and not as findings about this case, include compromised credentials, phishing that yields remote access, misconfigured cloud storage, vulnerable remote-access software, or a third-party service provider that itself suffers a compromise. Once inside, an attacker may copy databases, export document folders, or exfiltrate email archives that contain identity and financial details.

Accounting and tax practices are frequent targets because the data they hold—tax identifiers, income figures, bank details, and correspondence—has clear resale and fraud value. Attackers do not always encrypt systems for ransom; sometimes the goal is quiet theft of records for later identity misuse. Detection can lag if logging is limited or if the intrusion is confined to a single workstation or shared folder. None of these patterns is attributed to the Mather & Co event; they simply illustrate how personal-information breaches at professional-services firms generally arise when public detail on method is absent.

Mather & Co CPAs LLC and its sector

Mather & Co CPAs LLC is a certified public accounting practice. Firms of this type prepare tax returns, maintain books, advise on financial statements, and often hold copies of clients’ government identifiers, payroll data, bank account information, and supporting personal documents. Even a small practice routinely concentrates high-value personal and financial records in a relatively compact digital environment.

A breach at such an organization matters because the data is both sensitive and durable. Tax and accounting files are retained for years. Clients trust the firm with information they would not casually share elsewhere. When that trust is interrupted by unauthorized access, the consequences fall on individuals who may have no other relationship to the firm beyond a single engagement. The Indiana notice indicates the firm met a state reporting duty for residents whose information was involved, underscoring that professional-services breaches are treated as consumer-protection matters even when the absolute headcount is low.

What was likely exposed

The breach notification names the exposed category as personal information. It does not itemize fields such as Social Security numbers, driver’s license numbers, financial account numbers, or tax documents in the summary provided. For an organization of this kind, typical holdings include names, addresses, dates of birth, taxpayer identification numbers, income and deduction details, and sometimes banking or payment data used for filings and refunds. Those categories are characteristic of CPA work; they are not confirmed as the precise contents of this incident.

Because the public record stops at “personal information,” any assumption about exact data elements remains unconfirmed. Affected individuals should rely on the letter they received from the firm, which ordinarily lists the specific types of information believed to have been involved for that person. Until more detail is released, the safe posture is to treat the exposure as identity-relevant personal data without asserting unlisted fields as fact.

The real-world impact

For the seventeen people identified, the primary risks are identity theft, tax-refund fraud, and account takeover. Stolen personal information can be used to file false returns, open credit lines, or socially engineer banks and government agencies. Even when the number of victims is small, each person faces the same practical burden: monitoring credit, watching for unexpected tax correspondence, and remaining alert to phishing that references the firm or recent filings.

For the organization, the incident creates notification costs, potential regulatory follow-up, and reputational strain with clients who expect confidentiality as a core professional duty. A limited headcount does not eliminate those pressures; it simply concentrates them. No dollar losses, litigation outcomes, or findings of fault are stated in the available facts, and none should be inferred.

What to do if you're exposed

If you received a notice from Mather & Co CPAs LLC, read it carefully for the exact data types listed and any offer of credit monitoring. Place a fraud alert or security freeze with the major credit bureaus, and review IRS and state tax account activity for unfamiliar filings. Change passwords on email and financial accounts, especially if you reused credentials with the firm, and treat unsolicited calls or emails about the breach with caution. Keep the notice for your records. As an additional check, you can run a free exposure scan of your email address to see whether that address has already appeared in other known breach datasets, which helps gauge whether wider monitoring is warranted.

AICompiled with AI assistance from public sources and published under our editorial standards.