Coston and McIsaac, CPAs data breach

What we know

Coston and McIsaac, CPAs is a professional accounting and financial services firm that handles highly confidential corporate and individual accounts throughout Massachusetts. Because of the nature of their business, the firm routinely collects, processes, and stores vast quantities of sensitive financial records, corporate tax documents, and personal identifying information. Clients entrust Coston and McIsaac with their livelihoods, relying on the firm to manage everything from annual tax filings to complex business asset valuations and payroll reconciliations. As a result, their digital environment serves as a centralized repository for some of the most critical and private financial data an individual or business can possess. In 2025, Coston and McIsaac, CPAs reported a significant data security incident to the Massachusetts Attorney General's Office. While the exact vector of the breach remains under investigation, incidents involving accounting and financial institutions frequently stem from unauthorized network intrusions, sophisticated phishing campaigns targeting staff credentials, or vulnerabilities within third-party document-sharing portals. When cybercriminals breach a CPA firm, they gain direct access to environments where years of archived financial and personal records are stored, making these attacks particularly devastating for the firm's client base. The compromised information in accounting firm data breaches typically encompasses a dangerous combination of personal and financial data elements. Victims often see their full names, Social Security numbers, dates of birth, home addresses, and private tax return information exposed. This specific mix of data creates severe, long-term risks for affected individuals. Social Security numbers and birth dates form the building blocks of identity theft, while exposed tax returns and financial account details provide bad actors with the precise blueprints needed to execute tax fraud, open fraudulent lines of credit, or hijack existing bank accounts. Under federal and state law, including the Massachusetts Data Security Regulations (201 CMR 17.00) and general professional standards of care, accounting firms like Coston and McIsaac have a strict legal duty to implement and maintain robust administrative, physical, and technical safeguards to protect client data. This includes encrypting sensitive files, enforcing multi-factor authentication, and conducting regular security audits. The occurrence of a widespread data breach strongly suggests that these mandatory security protocols may have been compromised or inadequately maintained, pointing to potential negligence in data protection practices. Receiving an official data breach notification letter from Coston and McIsaac, CPAs is an official acknowledgment that your private financial information was exposed due to inadequate security measures. Legally, this notification establishes the standing necessary to participate in a class action lawsuit aimed at holding the firm accountable. Importantly, victims do not need to prove that they have already suffered actual financial loss to seek legal recourse; the increased risk of future identity theft and the time and expense required to monitor your credit are actionable harms. Our firm evaluates these cases on a contingency fee basis, meaning you pay nothing unless we successfully recover compensation on your behalf.

See every breach reported in Massachusetts or read what to do after a ransomware attack.