HackingProfessional ServicesProfessional ServicesStolen CredentialsMulti-Stage ChainCustomer Data InvolvedData ExfiltratedIdentity (basic)Government IDFinancial accountFinancial credentialsHealth (basic)MediumContained

John N. Fernez CPA, LLC

bd_ab31eca5ad1db4ce · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 16, 2025

Filed

Jun 13, 2025

To disclose

8 weeks

Affected · nationwide

341 in this filing

Linked

2 filings

Confidence

67%

Full breach record for John N. Fernez CPA, LLC →

John N. Fernez CPA, LLC reported a security breach where an unauthorized individual compromised its Intuit cloud-based tax software credentials. The actor filed fraudulent tax returns for 34 clients, exposing PII including SSNs, financial data, and health insurance info. Fernez LLC notified the IRS, changed passwords, and offered 24 months of credit monitoring. The incident was discovered on April 16, 2025, and notifications were mailed on June 13, 2025.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 8 weeks / 58 days

Apr 16, 2025

Discovered

Jun 13, 2025

Filed

vs. sector median

10 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_e0099d19650e93e62025-06-13Verified

Name: John N. Fernez CPA, LLC
norm: john n fernez cpa

Name: John N. Fernez CPA, LLC
norm: john n fernez cpa
Industry: Professional Servicesllm

Discovered: Apr 16, 2025
Materiality determined: —
Notification sent: Jun 13, 2025
Affected individuals: 34state + nationwide
Data types: Identity (basic)Government IDFinancial accountFinancial credentialsHealth (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: Notified the Internal Revenue Service (IRS)
Third party: via Intuit
Initial access: valid_credentials

During the incident: Changed account passwords with Intuit
Contacted each impacted client by telephone
Notified the Internal Revenue Service (IRS) of the breach
Deactivated its Electronic Filer Identification Number (EFIN)
Mailed notification letters to impacted individuals
Offered credit monitoring and fraud assistance services for two years
Changes made: Implemented multi-factor authentication
Enhanced security protocols and password policies
Performed deep scan of all devices for malware and viruses
Changed all passwords related to financial and tax applications
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(58 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGJun 13 · first

New Hampshire State AGJun 13 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/john-n-fernez-cpa-20250613.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 13, 2025
Raw hash: 96814e01d2186f51b44f885b15bf860400516ded2fa4654f14405bf82a2448c1

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityJohn N. Fernez CPA, LLC

Victim entityJohn N. Fernez CPA, LLC

Incidentdiscovered Apr 16, 2025

Stated responseChanged account passwords with Intuit

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov