Michael J. Berger and Co., CPA LLP has reported a data breach to the Vermont Attorney General. The filing says five Vermont residents were affected and that Social Security numbers and financial account information were involved.
Michael J. Berger and Co., CPA LLP’s Data Breach Investigation
Michael J. Berger and Co., CPA LLP is a certified public accounting firm, according to the name under which it filed its notice. Firms of this kind prepare tax returns, keep books and advise on money matters, so their files commonly hold the exact details identity thieves look for: Social Security numbers, bank and card account information, and income records for individuals and for the businesses they run.
On October 21, 2026, the firm reported a security breach to the Vermont Attorney General. The state’s public register of breach notices lists the filing and summarizes it in a few fields: the date reported, the organization’s name and type, the number of Vermont residents affected, and the categories of data involved. For this filing, the register shows five Vermont residents affected, and it names Social Security numbers, financial account codes and credit or debit account information as the data categories.
That count needs context. The figure covers only the people in Vermont whose information was involved. Businesses that suffer a breach usually have to notify residents of every state where affected people live, and each state’s regulator records only its own residents. A firm serving clients across several states can therefore have a total that is much higher than any single state’s number. Michael J. Berger and Co., CPA LLP has not published a total, and this page does not estimate one.
The public record also leaves several basic questions open. The register does not describe how the incident happened, which systems or files were involved, how long an unauthorized party may have had access, or whether any information was actually misused. It does not say whether the firm offered affected people credit monitoring or identity protection. The notice sent to consumers is not posted online. The Vermont Attorney General’s Office says it no longer posts third-party notice documents and that a sample consumer notice can be requested from its office. For that reason, this page reports only what the state summary shows and avoids guessing at the cause.
Accounting practices are a recurring target for cybercriminals for a simple reason: a single client folder can hold a name, address, date of birth, Social Security number and bank details together. That combination is what makes tax-season fraud, fraudulent loan applications and account takeover possible. Stolen tax-preparation data can also be used to file a false return in someone’s name before the real taxpayer files. Those are general risks associated with this kind of information, not findings about what happened to any person in this particular incident.
Anyone who received a letter from Michael J. Berger and Co., CPA LLP should read it closely. The notice will describe what the firm says occurred, which of your details were involved and what protections, if any, are being offered. Keep the letter, note any enrollment deadline it gives, and save any envelope or reference number. Having the notice on hand helps if you later need to show when and how you learned your information was exposed. Questions about whether a failure to protect client data played a part are the kind attorneys can examine on behalf of people who were harmed.
People who were clients of the firm but did not receive a letter may want to be careful anyway. Notices go out on the firm’s own timetable and use mailing addresses it has on file, and a letter can be delayed, misdirected or set aside as junk mail. If you shared tax or financial records with the firm, it is reasonable to monitor your accounts and credit reports now rather than waiting. The steps listed below are inexpensive and take little time, and they protect you whether or not this incident ever touches your information.
When Did This Breach Occur?
The Vermont Attorney General’s register lists the filing as reported on October 21, 2026. The register does not say when the underlying incident took place or when the firm discovered it, and the firm has not published a timeline.
The report date is not necessarily the date of the incident. Your notice letter, if you receive one, is the best source for the dates that apply to you.
What Information Was Breached?
According to the Vermont Attorney General’s register, the categories of data involved were Social Security numbers, financial account codes, and credit or debit account information.
The register lists categories only. It does not show which categories apply to each person, so your own notice letter is the authoritative source for what was involved in your case.
What You Can Do
If you received a notice related to Michael J. Berger and Co., CPA LLP or believe you may be affected, consider these steps:
- Read the notice carefully and keep it, along with any enrollment details for protection services it offers.
- If the notice offers credit monitoring or identity protection, note the enrollment deadline and sign up, and consider asking the IRS about an Identity Protection PIN to guard against a fraudulent tax return.
- Place a free fraud alert or a credit freeze with Equifax, Experian and TransUnion, and get your reports free at annualcreditreport.com.
- Review bank, card and insurance statements for anything you do not recognize.
- Be skeptical of unexpected calls, texts or emails that mention the incident, and report suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against Michael J. Berger and Co., CPA LLP
If you are notified that your personal information was exposed in an incident involving Michael J. Berger and Co., CPA LLP, you may have legal options. Companies are expected to safeguard the sensitive information entrusted to them, and a class action can help hold them accountable when they fail to do so.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
