Sax, LLP data breach

What we know

Sax, LLP operates as a prominent professional services firm specializing in accounting, tax preparation, auditing, and financial consulting for high-net-worth individuals, corporate clients, and commercial enterprises. Because of the core nature of their business, the firm routinely collects, processes, and stores an extensive volume of highly sensitive personal and financial data. This includes comprehensive tax records, corporate governance documents, banking information, compensation details, and identifying numbers necessary for financial reporting and advisory services. Consequently, Sax, LLP occupies a position of immense trust, serving as a repository for the most confidential records of its clientele.

In 2025, Sax, LLP reported a cybersecurity incident to the Montana Attorney General's office, alerting affected consumers that unauthorized actors had gained access to their network environment. Security incidents affecting accounting and professional services firms typically involve sophisticated intrusions, such as unauthorized access to legacy databases, targeted credential harvesting, or ransomware attacks deployed by cybercriminal syndicates seeking to exploit the high value of financial data. These threat actors frequently target corporate networks to harvest sensitive records that can be monetized on underground forums or utilized in complex financial fraud schemes.

Data breach notification letters dispatched by financial and professional service firms generally reveal the exposure of critical personally identifiable information (PII) and financial identifiers. For clients of an accounting firm like Sax, LLP, this typically includes full names, Social Security numbers, dates of birth, detailed tax return data, banking and direct deposit information, and corporate financial records. The exposure of this combination of data creates severe, compounding risks. Social Security numbers and dates of birth form the bedrock of identity theft, enabling threat actors to open fraudulent credit lines or file fraudulent tax refunds in the victim's name. Furthermore, compromised banking and tax data leaves victims uniquely vulnerable to targeted financial account takeovers and sophisticated phishing attacks.

Under federal and state regulations, including the Gramm-Leach-Bliley Act where applicable to financial service providers, as well as overarching state consumer protection statutes, firms like Sax, LLP have a strict legal duty to implement and maintain robust administrative, technical, and physical safeguards to protect sensitive client data. This includes employing multi-factor authentication, robust encryption standards, regular vulnerability assessments, and strict access controls. A successful data breach of this magnitude serves as strong evidence of a potential failure in these security protocols, suggesting that the firm may have fallen short of industry-standard security requirements.

Receiving a data breach notification letter from Sax, LLP is a formal acknowledgment that your private information was compromised due to inadequate security measures. Legally, this notification establishes the foundation for affected individuals to participate in a class action lawsuit seeking accountability, compensation for mitigation efforts, and mandatory improvements to corporate data security practices. You do not need to prove that financial fraud has already occurred to join a legal claim; the increased risk of future identity theft is legally recognized injury. Our firm handles these complex data privacy cases on a contingency fee basis, meaning you pay nothing out of pocket and owe no attorney fees unless we successfully recover compensation on your behalf.

See every breach reported in Montana or read what to do after a ransomware attack.