H&E Business and Tax Consultants, LLC, which does business as Perry, Roane & Henley, has sent a notice to people about an incident that it says may affect some of their information. A sample of the letter was posted on the Massachusetts state website among its notification letters for November 2026.
The letter offers complimentary credit monitoring but gives very little detail about what happened. This page explains what the letter does and does not say.
Perry, Roane & Henley’s Data Breach Investigation
H&E Business and Tax Consultants, LLC, doing business as Perry, Roane & Henley, wrote to notify people of an incident that it says may affect some of their information. The letter appears among the data breach notification letters that the state of Massachusetts posts for public viewing, in the list for November 2026. The copy that was posted is a template, with blank fields where a recipient’s name, address, date and activation code would normally appear. It gives the firm’s address as 149 2nd Avenue in Niwot, Colorado. The firm’s own website describes accounting, advice and tax services at the same address.
The letter says that, because of the requirements of Massachusetts law, the firm is unable to provide further details about the nature of the incident. That is an important point for readers. Massachusetts notices are often much shorter than notices sent in other states, because the state limits what a notice may say about the nature of a breach. As a result, this letter does not say what kind of incident occurred, when it took place, or how it was discovered. It does not say who was behind it, and it does not say how many people are affected.
What the letter does describe is the firm’s response. It says that, in an abundance of caution, the firm is offering complimentary access to credit monitoring services and encourages people to enroll by following the instructions in the notice. It says the firm is implementing additional technical security measures and is reviewing and enhancing its existing policies and procedures.
The credit monitoring is provided through Epiq, under a plan the letter calls Epiq Monitoring Solutions 3B Credit Monitoring. In the posted template, the length of coverage and the enrollment deadline were left as unfilled merge fields, so this page cannot say how many months of coverage each person receives or when the offer ends. The letter lists features such as monitoring of all three credit bureaus with alerts, a VantageScore credit score with a score tracker, Social Security number monitoring, dark web monitoring, change of address monitoring, help with credit freezes, and identity restoration assistance. It also describes identity theft insurance and reimbursement coverage for unauthorized electronic fund transfers, subject to the terms of the underlying policies.
The letter does not say what categories of personal information were involved. It does not say whether the people who received it are clients, employees or someone else. We searched for other public information about this filing, such as a notice on the firm’s website or a report from another state, and found nothing we could tie to it. This page therefore does not guess at the cause or the type of data. Anything stated here comes only from the posted letter.
A notice that offers credit monitoring is a sign that the firm considers some risk of identity misuse to be possible, but it does not by itself show which information was involved. Tax and accounting firms hold financial and identity details for their clients, so readers who have worked with any accounting or tax preparer should take a notice from one seriously, even when the details are thin. Identity theft, fraud and misuse of accounts can happen long after an incident, so the protective steps in the notice, such as watching account statements, reviewing credit reports and considering a fraud alert or credit freeze, are worth taking sooner rather than later.
State laws set deadlines and content rules for breach notices, and they differ from state to state. Most states require a company to notify affected residents without unreasonable delay, and many require a report to the state attorney general once a breach reaches a certain size. Because each state publishes different details, the same incident can look very different depending on which filing a reader finds. A thin notice in one state does not mean the incident was small, and a longer notice in another state may add details that this page does not yet have.
Anyone who received a letter from Perry, Roane & Henley should read it closely and keep it, along with the activation instructions for the credit monitoring service. If you think you may have been affected but have not received a notice, this page cannot tell you whether your information was involved, and only the firm can answer that. The facts here come only from the posted letter and may change if the firm shares more.
When Did This Breach Occur?
The posted letter is undated, and it does not say when the incident happened or when the firm learned of it. It appears in the Massachusetts list of notification letters for November 2026.
Until the firm or a regulator publishes more, the timeline of the incident is not publicly available. The notice you receive may give more information about the dates involved.
What Information Was Breached?
The letter does not say what kinds of personal information were involved. It refers only to an incident that may affect the privacy of some of your information.
Because the firm has not listed the data types, this page does not guess at them. The notice you receive is the best indication of what was involved in your case.
What You Can Do
If you received a notice related to Perry, Roane & Henley or believe you may be affected, consider these steps:
- Read the notice carefully and keep it, along with any enrollment details for protection services it offers.
- Enroll in the free Epiq credit monitoring offered in your letter, using the activation code it provides, and note the enrollment deadline printed in your own notice.
- Place a free fraud alert or a credit freeze with Equifax, Experian and TransUnion, and get your reports free at annualcreditreport.com.
- Review bank, card and insurance statements for anything you do not recognize.
- Be skeptical of unexpected calls, texts or emails that mention the incident, and report suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against Perry, Roane & Henley
People whose personal information is exposed in a data security incident may have legal options if the company failed to use reasonable safeguards to protect it. Whether a claim exists depends on the facts, including what information was involved and how the company responded. If you received a notice from Perry, Roane & Henley, or believe your information may have been exposed, you can learn more about your options below.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
