HackingProfessional ServicesProfessional ServicesStolen CredentialsData ExfiltratedCustomer Data InvolvedGovernment IDIdentity (basic)MediumContained

Mercadien, P.C. CPAs

bd_3c090c1ae9c35738 · schema v1 · pii pii-v2

Severity

Medium

Discovered

Nov 7, 2025

Filed

Oct 12, 2026

To disclose

48 weeks

Affected

Not disclosed

Linked

12 filings

Confidence

67%

Mercadien, P.C. CPAs reported a data security incident detected on November 7, 2025, where an unauthorized third party accessed files containing client names and Social Security Numbers. The breach affected approximately 436 Rhode Island residents. Mercadien offered complimentary credit monitoring via Experian and confirmed the incident was contained.

J jump to incidentP pin to compareR raw source

California clockDiscovered Nov 7, 2025 → Notified Sep 15, 2026312d ✗ CA 60-day late48 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

discovery → filing · 48 weeks / 339 days

Nov 7, 2025

Discovered

Oct 12, 2026

Filed

vs. sector median

+29 wks slower

This filing is one of 12 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Oregon State AGbd_9073a5be3f931a412026-10-12Verified
Texas State AGbd_cc54cf6a9eb2d0c22026-10-13 · +1dVerified
New Hampshire State AGbd_aea05dfcc088a1bf2026-07-20 · +84dVerified
Texas State AGbd_7b787e3dbbd82d8e2026-02-24 · +230dVerified

Show 6 more filings ↓up to 285d gap

South Carolina State AGbd_bb8b76494cae40c62026-02-23 · +231dVerified
Indiana State AGbd_5a136d8dad7a13462026-02-17 · +237dVerified
Nebraska State AGbd_9581ab095364e27d2026-02-17 · +237dVerified
Delaware State AGbd_b06b2f75cc90e4452026-02-17 · +237dVerified
New Hampshire State AGbd_6a472f77725ed7622026-01-05 · +280dVerified
Maine State AGbd_be4f63906a17f7282025-12-31 · +285dCandidate

Showing first 10 of 11 linked disclosures.

Name: Mercadien, P.C. CPAs
norm: mercadien

Name: Mercadien, P.C. CPAs
norm: mercadien
Industry: Professional Servicesllm

Discovered: Nov 7, 2025
Materiality determined: —
Notification sent: Sep 15, 2026
Affected individuals: Not disclosed
Data types: Government IDIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Initial access: valid_credentials

During the incident: Detected the data security incident
Took steps to remediate and contain the incident
Completed a third-party investigation
Completed a comprehensive data analysis of the files involved
Offered free credit monitoring through Experian
Changes made: Enhance our data protection procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 48 weeks(339 days from discovery to filing)
Compliance flags: CA 60-day late · 312dCA AG copy >15d · 27d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Nov 7, 2025
→ Notified: Sep 15, 2026
312d 60 days (analyst band, pre-2026 discoveries) CA 60-day late
California
Consumers notified: Sep 15, 2026
→ AG copy submitted: Oct 12, 2026
27d 15 calendar days CA AG copy >15d

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Nov 7, 2025 → Notified: Sep 15, 2026	312d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late
California	Consumers notified: Sep 15, 2026 → AG copy submitted: Oct 12, 2026	27d	15 calendar days	CA AG copy >15d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 9 states

View merged incident ↗

Maine State AGDec 31 · first

New Hampshire State AG+5d

Indiana State AG+48d

Nebraska State AG+48d

Delaware State AG+48d

South Carolina State AG+54d

Texas State AG+55d

New Hampshire State AG+201d

Oregon State AG+285d

California State AG+285d · this page

Texas State AG+286d

Pattern: first filing Dec 31 (ME), last Oct 13 (TX) — a 286-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 11 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-631182
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 12, 2026
Raw hash: cc0ca3080674635ff5478279ddf8f633ea38c007111d98776e8c12f5aa54bc5a

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityMercadien, P.C. CPAs

Victim entityMercadien, P.C. CPAs

Incidentdiscovered Nov 7, 2025

Stated responseDetected the data security incident

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov