RYBD disclosed a cybersecurity incident where attackers accessed a backup server and potentially exposed personal information, including names and other identifiers. Affected individuals are being offered identity protection services and should take immediate steps such as credit monitoring and fraud alerts. Companies that collect and store personal information have a responsibility to protect it with reasonable security measures.
Rhodes, Young, Black, and Duncan’s Data Breach Investigation
Rhodes, Young, Black, and Duncan (“RYBD”), a professional accounting and advisory firm, disclosed a significant cybersecurity incident involving unauthorized access to one of its backup servers. According to the notice, the firm first detected suspicious activity on October 12, 2025, which triggered an internal incident response process and the engagement of external cybersecurity and legal professionals. The goal of this response was to contain the environment, assess the scope of the intrusion, and determine what data may have been affected.
The investigation revealed that unauthorized actors gained access to RYBD’s network earlier, on September 17, 2025. During this window of unauthorized access, the attackers were able to exfiltrate data before the breach was identified and contained. This type of delayed detection is common in sophisticated cyber incidents, where threat actors maintain access for extended periods before discovery.
Following the identification of the intrusion, RYBD undertook a comprehensive forensic investigation with third-party specialists to understand the nature of the attack and what information may have been compromised. The firm stated that it worked diligently to identify all potentially affected individuals and evaluate the scope of the exposed data. On May 27, 2026, the investigation concluded that certain individuals’ personal information may have been accessed or acquired without authorization.
While the company did not disclose a full breakdown of the compromised data fields in the excerpted notice, it did indicate that the exposed information included at least individuals’ full names in combination with additional personal information. However, the specific categories of that additional data were not fully detailed in the disclosure provided, leaving some uncertainty about the overall sensitivity of the exposure.
RYBD emphasized that, to date, it has not found evidence that the impacted information has been misused for fraud or identity theft. Even so, the company chose to notify affected individuals out of an abundance of caution, reflecting a growing industry trend toward transparency even when downstream harm has not yet been confirmed.
As part of its response, RYBD is offering complimentary identity protection services, including credit monitoring, CyberScan monitoring, identity theft insurance coverage of up to $1 million, and fully managed identity theft recovery services. These protections are typically provided in cases where sensitive personal data may have been exposed, particularly when combined identifiers such as names and other personal details are involved.
The involvement of backup server access in this breach is also notable. Backup systems often contain large volumes of historical data, which can include tax documents, financial records, and client correspondence. While not all backup data is necessarily active or current, it can still contain sensitive identifiers that increase the risk of identity misuse if exposed.
This incident highlights the ongoing risks faced by financial and advisory firms that store high-value personal and tax-related data. Cybercriminals frequently target these organizations because of the concentration of sensitive identity and financial information. Even when firms have security measures in place, delayed detection can allow attackers to extract data before containment efforts begin.
For consumers, the lack of immediate clarity regarding the full scope of exposed data can be concerning. When companies are unable to specify exactly what was compromised, individuals are often left relying on precautionary protections such as credit monitoring and fraud alerts. This reinforces the importance of proactive identity protection steps following any confirmed data breach involving financial service providers.
When Did This Breach Occur?
RYBD identified unauthorized access on October 12, 2025. However, forensic investigation determined that the actual intrusion began earlier, on September 17, 2025, when unauthorized parties accessed the company’s network and exfiltrated data. The investigation was completed on May 27, 2026, at which point affected individuals were formally notified.
What Information Was Breached?
The company reported that impacted data may include personal information belonging to certain individuals. While the full scope was not exhaustively detailed, the notice confirms exposure of identifying information.
- Full name
- Additional personal information in combination with name (not fully specified in notice)
- Potentially sensitive identity-related or client record data (not detailed in disclosure)
What You Can Do
If you received a notice from Rhodes, Young, Black, and Duncan, it is important to take immediate steps to reduce the risk of identity theft or financial fraud. Even when a breach does not yet show evidence of misuse, exposed personal identifiers can still be used later in phishing, account fraud, or identity impersonation schemes.
Start by enrolling in the complimentary identity protection services offered by RYBD. These services include credit monitoring, CyberScan alerts, identity theft insurance coverage, and full identity restoration support. Activating these protections as soon as possible ensures that suspicious activity tied to your identity can be detected early.
You should also consider placing a fraud alert or credit freeze with the major credit bureaus—Equifax, Experian, and TransUnion. A fraud alert requires lenders to take extra steps to verify your identity before opening new accounts, while a credit freeze restricts access to your credit file entirely, helping prevent unauthorized account creation.
It is also recommended that you regularly review your credit reports for any unfamiliar accounts or inquiries. If anything appears suspicious, report it immediately and consider filing a report with the Federal Trade Commission or local law enforcement.
Finally, remain alert for targeted phishing attempts, especially emails or messages referencing tax services or identity verification, as these are common follow-up tactics after data breaches involving financial firms.
File a Data Breach Lawsuit Against Rhodes, Young, Black, and Duncan
If Rhodes, Young, Black, and Duncan failed to adequately safeguard your personal information, you may have legal rights to pursue compensation through a data breach or mass arbitration claim. Individuals affected by cybersecurity failures may be entitled to damages related to time spent mitigating fraud risk, credit monitoring expenses, and potential losses tied to identity misuse.
Companies that store sensitive financial and tax-related data are expected to implement reasonable security safeguards. When those safeguards fail and personal information is exposed, affected individuals may be eligible to pursue legal action together to hold organizations accountable and seek financial recovery.
If you received a notification from RYBD, enrolled in credit monitoring services, or believe your personal information may have been impacted, you may qualify to join others in taking legal action.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
