2026 Mercadien, P.C. CPAs — intrusion detected November 2025; names and Social Security numbers from financial-institution work
Data compromised
Names and Social Security numbers, per the notice.
Technical writeup
Notice dated October 12, 2026, listed by the California Attorney General. Mercadien provides accounting and advisory services to financial institutions and says it has no indication the information has been misused. This is separate from the second Mercadien notice listed October 20, 2026, which covers a September–October 2025 vulnerability. Count not stated. recordsAffected 0.
Root cause
Mercadien detected the incident on November 7, 2025, contained it and completed a third-party investigation that confirmed an unauthorised party accessed files from its systems. On August 13, 2026 it determined that the files included information received from financial institutions for advisory engagements.