2026 Mercadien, P.C. CPAs — vulnerability exploited September–October 2025; names and Social Security numbers exposed
Data compromised
First and last name and Social Security number. In some limited instances, driver’s license number, date of birth and bank account number.
Technical writeup
Notice dated October 20, 2026, listed by the California Attorney General the same day. This is separate from the October 12 Mercadien notice (a November 2025 detection). Count not stated. recordsAffected 0.
Root cause
An unauthorised party accessed Mercadien’s environment by exploiting a security vulnerability between September 17 and October 8, 2025. After a third-party investigation and file review, the firm provided its findings on August 14, 2026. The notice says Mercadien’s work for banks concluded in 2023.