2024 Sax LLP cyberattack — ~220,000 individuals notified after delayed 2026 disclosure
Data compromised
Names, dates of birth, Social Security numbers, driver’s license/state ID numbers per notice summaries
Technical writeup
Sax LLP, a U.S. Top 100 accounting and advisory firm, notified individuals in 2026 that a cyberattack compromised sensitive personal data for approximately 220,000 people following an intrusion tied to calendar year 2024. Trade press (SecurityWeek, Accounting Today) described a prolonged gap between the incident and public disclosure—on the order of sixteen months—before Sax concluded investigations and began regulatory notifications. Compromised categories reported in summaries include names, dates of birth, Social Security numbers, and driver’s license or state ID numbers, varying by individual. BreachHistory indexes this as a delayed-disclosure professional-services breach rather than a 2026 intrusion year, with `reportedAt` reflecting the 2026 notice cycle.
Root cause
Cyberattack against Sax LLP systems (public technical root cause not fully detailed in initial notices)