HackingFinancial ServicesProfessional ServicesFinanceStolen CredentialsEmail MisuseCustomer Data InvolvedEmployee Data InvolvedTargetedIdentity (basic)Government IDFinancial accountFinancial credentialsHealth (basic)CredentialsPIIHighContained

Kerkering, Barberio & Co., Certified Public Accountants

bd_87bdbb2448186060 · schema v1 · pii pii-v1

Severity

High

Discovered

May 27, 2025

Filed

Mar 13, 2026

To disclose

41 weeks

Affected · nationwide

4,1793 in this filing

Linked

3 filings

Confidence

65%

Full breach record for Kerkering, Barberio & Co., Certified Public Accountants →

Kerkering, Barberio & Co., a CPA firm, disclosed an external system breach (hacking) on May 25, 2025, discovered May 27, 2025. Unauthorized access to four email accounts exposed PII including SSNs, driver's licenses, bank details, and health IDs. 4,179 individuals affected; 3 in Maine. Notifications sent March 13, 2026, offering 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered May 27, 2025 → Filed with AG Mar 13, 2026290d ✗ ME AG >90d41 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 2 days

discovery → filing · 41 weeks / 290 days

May 25, 2025

Begins

May 27, 2025

Discovered

Mar 13, 2026

Filed

vs. sector median

+33 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Nebraska State AGbd_f12034b394a33d472026-03-13Verified
New Hampshire State AGbd_fb5c88001a8620062026-03-12 · +1dVerified

Name: Wilson, Elser, Moskowitz, Edelman & Dicker LLP
norm: wilson elser moskowitz edelman dicker
Domain: wilsonelser.com

Name: Kerkering, Barberio & Co., Certified Public Accountants
norm: kerkering barberio co certified public accountants
Industry: Financial ServicesllmProfessional Servicesllm

Discovered: May 27, 2025
Breach occurred: May 25, 2025
Undetected for: 2 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 13, 2026
Affected individuals: 4,179state + nationwide
Data types: Identity (basic)Government IDFinancial accountFinancial credentialsHealth (basic)CredentialsPII
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: Notified Maine Attorney General
Initial access: valid_credentials

During the incident: Isolated the affected email accounts
Engaged a specialized third-party cybersecurity firm to assist with securing the email accounts
Conducted a comprehensive forensic investigation
Engaged a third-party data mining vendor to conduct a comprehensive review of the potentially accessed data
Engaged a third-party notification vendor to assist with notifying the affected individuals
Disconnected all access to the impacted email accounts
Changed administrative credentials
Restored operations in a safe and secure mode
Enhanced the security measures
Offered 12 months of complimentary credit monitoring and identity theft restoration services through Cyberscout
Changes made: Enhanced the security measures
Changed administrative credentials
Disconnected all access to the impacted email accounts
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 41 weeks(290 days from discovery to filing)
Compliance flags: ME AG >90d · 290dME resident >180d · 290d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: May 27, 2025
→ Filed with AG: Mar 13, 2026
290d 90 days ME AG >90d
Maine
Discovered: May 27, 2025
→ Notified: Mar 13, 2026
290d 180 days ME resident >180d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: May 27, 2025 → Filed with AG: Mar 13, 2026	290d	90 days	ME AG >90d
Maine	Discovered: May 27, 2025 → Notified: Mar 13, 2026	290d	180 days	ME resident >180d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

New Hampshire State AGMar 12 · first

Nebraska State AG+1d

Maine State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/c5e0fa5c-23cb-420c-b406-9250eb91053a.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 13, 2026
Raw hash: fe586b8ce9dcb82b9c981f42d4956068a8ca653bb9d1aead5d2af2d893c5ed86

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityWilson, Elser, Moskowitz, Edelman & Dicker LLP

Victim entityKerkering, Barberio & Co., Certified Public Accountants

Incidentdiscovered May 27, 2025

Stated responseIsolated the affected email accounts

ComplianceME AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov