RSM US LLP data breach

What we know

RSM US LLP is one of the premier tax, audit, and consulting firms in the United States, operating as a vital financial intermediary for middle-market businesses, high-net-worth individuals, and large corporate entities. Because of the sophisticated scope of its professional services, RSM routinely collects, processes, and stores vast quantities of highly confidential financial, corporate, and personal information. This includes detailed corporate accounting records, investment portfolios, proprietary business strategies, and extensive personally identifiable information (PII) belonging to clients, partners, and employees alike. The firm functions as a central repository for sensitive financial data, making its digital infrastructure an attractive target for malicious actors seeking to exploit valuable enterprise and individual records. In 2025, RSM US LLP reported a significant data security incident to the Office of the Massachusetts Attorney General, signaling a breach of the digital safeguards protecting its systems. While details surrounding the precise vector of the intrusion continue to emerge, incidents affecting major accounting and professional services firms typically involve sophisticated unauthorized access to internal databases, targeted malware, or vulnerabilities within third-party vendor networks. In many professional services breaches, cybercriminals manage to penetrate network perimeters to access centralized document management systems, shared client drives, or legacy databases where comprehensive financial documents and personal files are archived. The exposure resulting from a breach at an enterprise of this caliber invariably involves highly sensitive data categories that create severe, long-term risks for affected individuals. Compromised data elements frequently include full names, dates of birth, Social Security numbers, banking and direct deposit details, detailed tax return documentation, and corporate compensation records. The exposure of Social Security numbers and tax documents provides identity thieves with the foundational components necessary to commit complex tax fraud, open fraudulent lines of credit, or execute account takeovers. Unlike transient data, core identity credentials cannot be changed, leaving victims exposed to the persistent threat of financial fraud for years after the initial incident. As a professional services firm handling sensitive personal and financial data, RSM US LLP was bound by robust legal and regulatory obligations to secure its digital environment. Under state data security statutes, common-law duties, and federal oversight regarding unfair and deceptive trade practices, the firm had an affirmative legal obligation to implement and maintain reasonable cybersecurity measures, encryption protocols, and intrusion-detection systems. The occurrence of a data breach compromising sensitive PII strongly suggests a failure in these fundamental security protocols, potentially exposing the firm to liability for negligence and statutory violations stemming from its failure to adequately safeguard confidential information. Receiving an official data breach notification letter from RSM US LLP is a formal acknowledgment that your private information was compromised due to inadequate security measures. Legally, this notification establishes the necessary standing to participate in a class action lawsuit aimed at holding the firm accountable for its security lapses. Affected individuals do not need to wait until they experience actual financial loss or identity theft to take legal action; the increased risk of future harm alone provides a valid basis for claims. Our law firm handles these complex data privacy cases on a contingency fee basis, meaning you pay nothing out of pocket and owe no legal fees unless we successfully recover compensation on your behalf.

See every breach reported in Massachusetts or read what to do after a ransomware attack.