Pena Briones McDaniel & Co., a certified public accounting firm based in El Paso, Texas, reported a data breach to the Texas Attorney General affecting 4,180 individuals. According to the filing, sensitive identity information was exposed, potentially putting affected individuals at risk of identity theft and fraud.
Accounting firms handle some of the most sensitive financial and identity information their clients possess, and have a legal and ethical responsibility to keep that information secure. When that trust is broken, affected individuals deserve to understand what happened and what options they have.
Pena Briones McDaniel & Co.’s Data Breach Investigation
According to a filing with the Texas Attorney General’s Office, Pena Briones McDaniel & Co. experienced a data security incident that resulted in the exposure of sensitive information belonging to 4,180 individuals. The filing indicates that exposed data categories included names, Social Security numbers, driver’s license numbers, and government-issued ID numbers. The firm notified affected individuals by U.S. Mail, and the incident was published to the Texas Attorney General’s data security breach report on August 19, 2025. The specific cause of the incident, along with the exact dates the breach occurred and was discovered, have not been publicly disclosed beyond the AG filing itself.
Accounting and tax preparation firms are frequent targets for cybercriminals because of the sheer concentration of sensitive client data they retain in one place. A single CPA firm’s client files often include Social Security numbers, dates of birth, bank account and routing numbers, prior years’ tax returns, and government-issued identification — everything needed to file a fraudulent tax return, open new credit accounts, or impersonate a victim to a financial institution. Because tax season creates a predictable annual surge in the volume of sensitive documents flowing into and out of these firms, accounting practices have increasingly become attractive targets for both external hackers and business email compromise schemes aimed at tricking staff into releasing client files.
Texas law, like most state data breach notification statutes, generally requires businesses to notify affected residents and the Attorney General’s Office without unreasonable delay once a breach involving sensitive personal information is discovered. These laws exist because the risks to consumers from a breach like this do not end on the day it is disclosed. The combination of a Social Security number, driver’s license number, and government-issued ID number is often described as a ‘fraud starter kit’ by security researchers, since together these data points can be enough to pass identity verification checks used by banks, lenders, and government agencies — enabling new-account fraud, synthetic identity creation, and fraudulent tax filings that can take victims months or years to fully resolve.
Individuals whose information was exposed in an accounting-firm breach like this one should also be alert to tax-related identity theft specifically, including fraudulent returns filed in their name or unexpected notices from the IRS about returns they never submitted. Beyond tax fraud, affected individuals are frequently targeted by follow-up phishing campaigns that use breach notifications as cover, sending fake ‘identity protection’ offers designed to extract even more personal information. Anyone who receives a notification letter from Pena Briones McDaniel & Co., or who believes their information may have been part of this incident, should treat the notice seriously and take the protective steps outlined below.
Data breach notification laws vary somewhat by state, but Texas, like most states, generally requires notice to affected residents and to the Attorney General’s Office once a business determines that a breach involving sensitive personal information has occurred. This framework is meant to give consumers a fair opportunity to respond before stolen data is put to use, but the timeline consumers see in a public filing — as with the Pena Briones McDaniel & Co. notice — usually reflects when an internal investigation concluded, not necessarily when the underlying incident took place. That gap is part of why ongoing vigilance matters: exposed data from a professional-services breach can be bought, sold, and used by different bad actors long after the notification letter first arrives, so a clean credit report or tax filing in the months right after a breach is not a guarantee of long-term safety.
Small and mid-sized professional-services firms like accounting practices often have fewer dedicated cybersecurity resources than large financial institutions, even though they hold comparably sensitive client files. This resource gap is a well-documented reason such firms are targeted at disproportionately high rates relative to their size, and it underscores why affected clients should not assume a breach at a smaller firm is any less serious than one at a major bank.
When Did This Breach Occur?
Pena Briones McDaniel & Co.’s data breach was published to the Texas Attorney General’s data security breach report on August 19, 2025, and affected individuals were notified by U.S. Mail around that same time. The exact date the underlying security incident occurred, and the date it was first discovered internally, have not been made publicly available in the filing.
What Information Was Breached?
According to the Texas Attorney General filing, the categories of information exposed in the Pena Briones McDaniel & Co. data breach include names, Social Security numbers, driver’s license numbers, and government-issued ID numbers. This combination of identity data makes affected individuals vulnerable to new-account fraud, tax fraud, and other forms of identity theft.
What You Can Do
If you received a notification letter from Pena Briones McDaniel & Co., or believe your information may have been affected, consider taking the following steps:
- Place a fraud alert or credit freeze with the three major credit bureaus (Equifax, Experian, and TransUnion).
- File your tax return as early as possible each year to reduce the risk of tax-related identity theft.
- Monitor IRS notices closely for any signs someone has filed a return in your name.
- Enroll in any free credit monitoring or identity protection services offered by the firm.
- Be cautious of unsolicited calls, texts, or emails referencing this breach, which may be phishing attempts.
- File a report with the Federal Trade Commission at IdentityTheft.gov if you suspect your information has been misused.
File a Data Breach Lawsuit Against Pena Briones McDaniel & Co.
If your personal information was exposed in the Pena Briones McDaniel & Co. data breach, you may have legal options available to you. Companies that fail to adequately protect sensitive client data can potentially be held accountable for the resulting harm.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
