Frazer LLP, a California-based certified public accounting and consulting firm, has notified people that their personal data may have been acquired without authorization in a March 2025 cybersecurity incident. The firm filed a sample notice with the California Attorney General on October 16, 2026.
Frazer LLP’s Data Breach Investigation
Frazer LLP is a regional certified public accounting and consulting firm headquartered in Anaheim, California, with an office in Visalia. According to its own website, the firm has operated since 1918 and provides accounting, audit, tax and consulting services to businesses, farms, dairies, organizations and individuals. Firms of this kind hold detailed financial records for their clients, which is part of why a security incident at an accounting practice deserves a close look.
The company’s notice letter, a sample of which it filed with the California Attorney General, says that on or about March 25, 2025, Frazer experienced a cybersecurity incident that affected connectivity to its network. The letter says the firm began an investigation right away and worked with outside cybersecurity professionals who handle incidents of this type. This page reports those statements as the firm’s own account rather than as independently confirmed findings.
The letter then describes a long review. After what it calls an extensive forensic investigation and comprehensive document review, Frazer says that on September 18, 2026 it determined that the personal data of the recipient may have been subject to unauthorized acquisition. It says the acquisition likely occurred between March 24, 2025 and March 25, 2025. In plain terms, the firm reports that data may have been taken, not merely that systems were disrupted, and that it took about eighteen months from the incident to reach that conclusion about individual data.
The notice does not say how many people were affected. The sample filed with the California Attorney General is a form letter with names, enrollment codes and the specific data fields blacked out, and the sources reviewed for this page do not publish a total. The letter contains legal notices for residents of Maryland, Massachusetts, New Mexico, New York, North Carolina and Washington, D.C., which suggests that people in several jurisdictions received it, but it gives no per-state figures and this page does not estimate any count.
Frazer says it has no evidence of financial fraud or identity theft related to the data. It is offering identity protection services through IDX, including credit and CyberScan monitoring, a $1,000,000 insurance reimbursement policy and fully managed identity theft recovery services. The letter sets a deadline of January 16, 2027 to enroll in the complimentary credit monitoring. The length of the monitoring period is not legible in the filed sample.
The long gap between the incident and the notice is worth understanding. Many state laws require organizations to notify affected people without unreasonable delay, and most allow time for an investigation to determine who was affected and what was involved. For a file-based incident, that determination can require reviewing a very large number of documents. A delay does not by itself show that the law was broken, and this page makes no claim about whether Frazer acted within the time allowed. It simply means that someone who receives a letter now may be learning about an event that happened well over a year ago.
Accounting and tax firms are a recurring focus for criminals because their files typically bring together the details needed to commit fraud in one place. Client records at a practice like this can include names, addresses, Social Security numbers, taxpayer identification numbers, tax returns and bank account information. That is general context about the profession, not a statement about which records were involved here. The notice says the information included each recipient’s full name together with other data elements that are blacked out in the public sample, so the exact categories are not publicly known.
Because tax and financial data is difficult to change, people affected by an incident like this often face risk for a long time. A stolen Social Security number cannot be reissued easily, and a fraudulent tax return filed in someone’s name can take months to untangle. For that reason, enrolling in the offered monitoring, placing a fraud alert or credit freeze, and watching for suspicious mail from the IRS or a state tax agency are sensible steps, whatever the final facts of the incident turn out to be.
Anyone who received a notice letter from Frazer should read it carefully. The letter is the best source for what happened in your case, which of your details were involved, and what support is offered. Keep the letter, the envelope and the enrollment instructions in a safe place. Receiving a notice is not a finding about fault, and whether the firm’s safeguards were adequate is a question that remains open on the public record. Those are the kinds of questions attorneys can ask on behalf of people who were harmed.
When Did This Breach Occur?
Frazer’s notice states that the incident occurred on or about March 25, 2025, and that the unauthorized acquisition of data likely occurred between March 24, 2025 and March 25, 2025. The firm says it determined on September 18, 2026 that personal data may have been acquired. The sample notice was reported to the California Attorney General on October 16, 2026.
If you received a letter, its own dates and description are the most reliable record of the timeline for your information. The sample letter sets a deadline of January 16, 2027 to enroll in the credit monitoring it offers.
What Information Was Breached?
Frazer’s letter says the information potentially affected includes the recipient’s full name and additional data elements. Those additional elements are redacted in the public sample, so the firm has not publicly disclosed a universal list. The letter also includes general guidance on protecting medical information, but the sample does not say whether any health data was involved.
The notice you receive should state which of your details were involved. Until then, it is prudent to treat any financial, tax, identity or insurance information you gave to the firm as potentially at risk.
What You Can Do
If you received a notice related to Frazer LLP or believe you may be affected, consider these steps:
- Read the notice carefully and keep it, along with any enrollment details for protection services it offers.
- Enroll in the IDX identity protection services before the January 16, 2027 deadline in your letter, and consider requesting an Identity Protection PIN from the IRS at irs.gov to help prevent fraudulent tax filings.
- Place a free fraud alert or a credit freeze with Equifax, Experian and TransUnion, and get your reports free at annualcreditreport.com.
- Review bank, card and insurance statements for anything you do not recognize.
- Be skeptical of unexpected calls, texts or emails that mention the incident, and report suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against Frazer LLP
If you received a notice about this incident, or believe your personal or financial information was exposed, you may have legal options. Firms that hold sensitive client information are expected to safeguard it, and a class action can help hold them accountable when they fail to do so.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
