HackingFinancial ServicesFinanceStolen CredentialsCapture App DataData ExfiltratedCustomer Data InvolvedDelayed DiscoveryTargetedWire FraudPIIIDENTITY_GOVERNMENTMediumResolved
Begin & Associates, CPA
bd_7a1d3aa50f731901 · schema v1 · pii pii-v1
Full breach record for Begin & Associates, CPA →Begin & Associates CPA (Saco, ME) discovered on July 16, 2025 that an unauthorized third party accessed their tax software system between March 23 and April 13, 2025, fraudulently filing a limited number of clients' 2024 tax returns. Potentially exposed data includes full names and Social Security numbers. 38 Maine residents were affected. The firm contacted the IRS and State of Maine, and is offering 12 months of IDX identity protection services to affected individuals.
Maine clockDiscovered Jul 16, 2025 → Filed with AG Jul 28, 202512d ✓ ME AG ≤30d12 days discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed38 affectedView incident
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/d1ae5129-9b1d-4d4c-92f8-2ae097530ecd.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jul 28, 2025
- Raw hash
- c81a926305fadbe76347dd5864bdb3990e852b6a4a6b4ec9f0f5d39ab6caabea
Reporting entity
- Name
- Begin & Associates, CPAnorm: begin associates cpa
- Domain
- begincpa.com
- Industry
- Financial Services
Victim entity
- Name
- Begin & Associates, CPAnorm: begin associates cpa
- Domain
- begincpa.com
- Industry
- Financial Services
- Industry
- Financial Servicesllm
Incident
- Discovered
- Jul 16, 2025
- Materiality determined
- Jun 25, 2025
- Notification sent
- Aug 1, 2025
- Affected individuals
- 38
- Data types
- PIIIDENTITY_GOVERNMENT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid AccountsT1530 Data from Cloud Storage
- Threat actor
- ExternalFinancial
- Regulator citations
- IRSState of Maine
Compliance
- Time to disclose
- 12 days(12 days from discovery to filing)
- Compliance flags
- ME AG ≤30d · 12d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Jul 16, 2025→ Filed with AG: Jul 28, 202512d 30 days ME AG ≤30d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.