Larry C. Kent, C.P.A., a Tucson, Arizona accounting practice, began sending data breach notices on October 1, 2026 after a data security incident that potentially involved clients’ personal information.
Larry C. Kent, C.P.A.’s Data Breach Investigation
Larry C. Kent, C.P.A. is an accounting and tax practice located on North Alvernon Way in Tucson, Arizona. In a notice dated October 1, 2026 and filed with the Massachusetts Attorney General, the practice told recipients that a recent data security incident potentially involved some of their personal information. The letter says the practice learned of the incident through an extensive investigation, and it expresses regret that it happened.
The filed copy of the notice has several blanks where the specific details would normally appear, including the line describing what information was involved, the length of the complimentary monitoring offered, and the call center hours. As a result, the practice has not publicly described which categories of personal information were exposed, how many people were affected, or when the incident began and ended. We are not guessing at any of those facts.
What the letter does confirm is the response it is offering. The practice is providing access to single bureau credit monitoring and identity theft protection through IDX, with an enrollment deadline of January 1, 2027. It also set up a dedicated call center that it says will be available for 90 days from the date of the letter, and it lists a toll-free IDX number for questions about the incident.
The notice encourages recipients to place a fraud alert and a security freeze on their credit files, to request a free credit report, and to keep reviewing financial account statements and credit reports for fraudulent or irregular activity on a regular basis. It also points to the steps available to residents of particular states.
Accounting practices hold some of the most sensitive records a person has. Tax returns, Social Security numbers, bank account information, income records, dependents’ details and prior-year filings are often stored together, and they are valuable because they can be used to file fraudulent returns or open accounts. A small practice may not have a large security team, and that is one reason attackers target professional services firms. We do not know which of these records, if any, were involved here.
Tax-related identity theft is a specific concern. A criminal who obtains the right combination of details can file a return in someone else’s name and claim the refund before the real taxpayer files. Victims often learn about it only when their own return is rejected. Anyone who may have been affected can consider requesting an IRS Identity Protection PIN, which adds a layer of verification to future filings. This is general background on this type of risk, not a confirmed fact about what happened to any individual’s information here.
Notices like this one often arrive well after an incident because the practice has to investigate, identify whose information was involved, and arrange monitoring services before it can write to anyone. If you are a current or former client of the practice, watch your mail for a letter and keep a copy for your records.
Smaller professional practices often rely on a mix of desktop software, cloud tax-preparation platforms, email and shared drives, and each of those is a possible way in for an attacker. Common causes of incidents at firms like this include phishing that captures a staff login, malware that copies files from a workstation, and weak or reused passwords on remote access tools. The notice does not say which, if any, of these applied here, and no cause should be assumed. Clients who sent documents by email or uploaded them to a portal may want to be especially attentive to unexpected messages that appear to come from the practice.
We will update this page if the practice or a regulator publishes more detail, such as the dates of the incident, the data types involved, or the number of people notified. In the meantime, the free monitoring offered in the letter and a credit freeze are low-cost ways to reduce the chance that exposed information is misused.
When Did This Breach Occur?
The notice is dated October 1, 2026. Larry C. Kent, C.P.A. has not publicly stated when the incident began, when it was discovered, or when the investigation concluded.
What Information Was Breached?
The filed copy of the notice leaves the description of the information involved blank, and the practice has not publicly disclosed which categories of personal information were affected. Accounting practices typically hold identifiers, financial account details and tax records, but which of these were involved here is unknown.
What You Can Do
If you received a notice from Larry C. Kent, C.P.A., consider these steps:
- Enroll in the complimentary IDX credit monitoring and identity protection using the code in your letter, before the January 1, 2027 deadline.
- Review your bank and card statements and any tax account activity for anything you do not recognize.
- Check your credit reports for free at annualcreditreport.com and consider a fraud alert or credit freeze with Equifax, Experian and TransUnion.
- Consider requesting an IRS Identity Protection PIN, and be cautious of messages that mention your accountant or tax documents.
- Report suspected identity theft to the Federal Trade Commission and your state Attorney General.
File a Data Breach Lawsuit Against Larry C. Kent, C.P.A.
If you received a notice that your information may have been involved in a Larry C. Kent, C.P.A. data breach, or you believe your information was put at risk, you may be entitled to compensation. Firms that hold financial and tax records are expected to take reasonable steps to protect them, and people affected by a breach can face a lasting risk of identity theft and fraud.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
