Frank, Rimerman + Co. LLP data breach

What we know

Frank, Rimerman + Co. LLP is a prominent accounting, tax, and business advisory firm providing comprehensive financial services to high-net-worth individuals, corporations, and complex business entities. Because of the sophisticated nature of their practice, the firm acts as a central repository for vast amounts of highly confidential personal, corporate, and financial information. Clients routinely entrust Frank, Rimerman + Co. LLP with sensitive tax records, corporate structuring documents, financial statements, and personal identifying details necessary for compliance, auditing, and wealth management. This concentration of lucrative and sensitive financial data makes the firm an attractive target for malicious cyber actors seeking to exploit institutional networks for financial gain. The 2025 security incident reported to the Massachusetts Attorney General highlights the escalating risks associated with the digital storage of professional financial records. While comprehensive forensic investigations continue to uncover the precise vectors of the breach, incidents of this scale typically involve sophisticated cyberattacks such as unauthorized intrusions into enterprise databases, ransomware deployments, or compromises of third-party vendor systems. Accounting and professional services firms frequently maintain legacy file systems alongside modern cloud infrastructure, creating potential blind spots that malicious actors actively probe to bypass perimeter defenses and exfiltrate proprietary data before detection. The data compromised in the Frank, Rimerman + Co. LLP breach exposes victims to severe, long-term risks of financial fraud and identity theft. Exposed records frequently include full legal names, Social Security numbers, dates of birth, detailed tax return information, wage and compensation records, and direct deposit account details. When Social Security numbers and comprehensive tax data are leaked simultaneously, malicious actors possess all the necessary components to perpetrate tax refund fraud, open unauthorized lines of credit, or execute account takeovers. Unlike transient credentials that can be easily reset, these immutable identifiers remain permanently tied to an individual, leaving victims vulnerable to repeated exploitation for years after the initial incident. As a professional services entity handling sensitive consumer and corporate data, Frank, Rimerman + Co. LLP was bound by rigorous legal and professional standards to safeguard this information. Under state consumer protection statutes, including the Massachusetts Data Security Regulations (201 CMR 17.00), businesses that own or license personal information about Massachusetts residents are legally mandated to maintain comprehensive, written information security programs. These legal obligations require the implementation of robust administrative, technical, and physical safeguards—such as encryption, multi-factor authentication, and regular vulnerability assessments—to prevent unauthorized access. The occurrence of a successful breach strongly suggests a potential failure to maintain these mandatory security protocols. Receiving a data breach notification letter from Frank, Rimerman + Co. LLP serves as formal legal notice that your private information was compromised due to institutional security lapses. Legally, this notification establishes the standing necessary to participate in a class action lawsuit aimed at holding the firm accountable for failing to protect your data. Under applicable law, affected individuals do not need to prove that they have already suffered actual financial loss or identity theft to pursue legal remedies; the increased risk of future harm and the cost of mitigating that risk are sufficient grounds for action. Our firm evaluates these cases on a contingency fee basis, meaning there are never any out-of-pocket costs or fees unless we successfully recover compensation on your behalf.

See every breach reported in Massachusetts or read what to do after a ransomware attack.