HackingProfessional ServicesProfessional ServicesStolen CredentialsData ExfiltratedCustomer Data InvolvedWire FraudIdentity (basic)Government IDMediumContained

Foard & Company, PA

bd_b690385ee82aaa9e · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 23, 2025

Filed

Mar 4, 2026

To disclose

23 weeks

Affected

Not disclosed

Linked

2 filings

Confidence

65%

Full breach record for Foard & Company, PA →

Foard & Company, PA notified clients that unauthorized parties accessed their systems and obtained personal information (name and Social Security number) to file fraudulent tax returns. The firm discovered the incident on September 23, 2025, after receiving rejection notices from the IRS. The firm contained the incident, enhanced security controls including MFA, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Massachusetts clock✗ MA AG >90d23 weeks discovery → filing

Incident timeline

discovery → filing · 23 weeks / 162 days

Sep 23, 2025

Discovered

Mar 4, 2026

Filed

vs. sector median

+4 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Nebraska State AGbd_ccad8342d658671d2026-03-04Verified

Name: Foard & Company, PA
norm: foard

Name: Foard & Company, PA
norm: foard
Industry: Professional Servicesllm

Discovered: Sep 23, 2025
Materiality determined: —
Notification sent: Mar 4, 2026
Affected individuals: Not disclosed
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified the Internal Revenue ServiceWorked closely with tax authorities to share information
Initial access: valid_credentials

During the incident: Changed passwords
Enhanced the implementation of multifactor authentication
Notified the Internal Revenue Service
Engaged data security and privacy professionals to assist
Worked closely with tax authorities to share information and take steps to protect our clients’ information
Added technical security protections on top of our existing safeguards by following the guidance of data security and privacy professionals
Offering complimentary access to Experian IdentityWorks for [Extra4] months
Changes made: Enhanced the implementation of multifactor authentication
Added technical security protections on top of our existing safeguards by following the guidance of data security and privacy professionals
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 23 weeks(162 days from discovery to filing)
Compliance flags: MA AG >90d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Nebraska State AGMar 4 · first

Massachusetts State AGMar 4 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.mass.gov/doc/2026-318-foard-company-pa/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 4, 2026
Raw hash: 539039692f86515b6bae1d38405921a5bb9a90bf765705e6b7d8a94180a03e6e

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityFoard & Company, PA

Victim entityFoard & Company, PA

Incidentdiscovered Sep 23, 2025

Stated responseChanged passwords

ComplianceMA AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.mass.gov