MalwareProfessional ServicesProfessional ServicesRansomwareData ExfiltratedCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDFinancial accountMediumContained

Michael J. Berger and Co., CPA LLP

bd_251c104c1b8a8ec6 · schema v1 · pii pii-v2

Severity

Medium

Discovered

Sep 19, 2025

Filed

Oct 21, 2026

To disclose

13 months

Affected

4state residents only

Linked

2 filings

Confidence

70%

Full breach record for Michael J. Berger and Co., CPA LLP →2 incidents on file

Michael J. Berger and Co., CPA LLP experienced a ransomware incident. Unauthorized access occurred on September 17, 2025, and was discovered on September 19, 2025. Data exfiltration was confirmed later. Four New Hampshire residents were affected, with exposure of names, Social Security numbers, and financial account information. The firm engaged forensic specialists, reset passwords, updated security controls, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 2 days

discovery → filing · 13 months / 397 days

Sep 17, 2025

Begins

Sep 19, 2025

Discovered

Oct 21, 2026

Filed

vs. sector median

+37 wks slower

This filing is one of 2 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Vermont State AGbd_ec1ac55ccde195202026-10-21Candidate

Name: Michael J. Berger and Co., CPA LLP
norm: michael j berger and co

Name: Michael J. Berger and Co., CPA LLP
norm: michael j berger and co cpa
Industry: Professional Servicesllm

Discovered: Sep 19, 2025
Breach occurred: Sep 17, 2025
Undetected for: 2 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 20, 2026
Affected individuals: 4state-resident count only
Data types: Identity (basic)Government IDFinancial account
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Reporting to other state regulatory offices where required

During the incident: Resetting account passwords
Implementing additional measures to bolster its security posture
Working under the guidance of specialists to restore its systems safely and investigate the nature and scope of the event
Reported to federal law enforcement
Engaged a third-party vendor to review the dataset involved
Offering twelve (12) months of single bureau credit monitoring, fraud consultation, and identity theft restoration services through Haystack to notified individuals whose Social Security numbers are involved
Changes made: Reviewing its existing security policies and protections
Adopting additional security to safeguard against evolving threats moving forward
Updated endpoint protection and firewall software
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 months(397 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Vermont State AGOct 21 · first

New Hampshire State AGOct 21 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/michael-j-berger-cpa-20261021.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 21, 2026
Raw hash: ad7e4e7662006e14fc310d9c00c5fdc385d3e5ac96afea3a9393a9ea3535274e

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityMichael J. Berger and Co., CPA LLP

Victim entityMichael J. Berger and Co., CPA LLP

Incidentdiscovered Sep 19, 2025

Stated responseResetting account passwords

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov