HackingProfessional ServicesProfessional ServicesStolen CredentialsCustomer Data InvolvedData ExfiltratedFinancial accountIdentity (basic)Government IDMediumContained

Town CPA, Nune Khachatrian, CPA, P.C

bd_ca15cb0a3e3d021f · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 1, 2026

Filed

May 15, 2026

To disclose

11 weeks

Affected

6state residents only

Confidence

66%

Full breach record for Town CPA, Nune Khachatrian, CPA, P.C →2 incidents on file

Town CPA, Nune Khachatrian, CPA, P.C. experienced a data incident in March 2026 where an unauthorized actor accessed client tax files, including names and Social Security numbers, likely to collect improper funds from government agencies. The firm contained the incident, notified the IRS and state authorities, and is offering 24 months of credit monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

Massachusetts clock⏱ MA AG >30d11 weeks discovery → filing

Incident timeline

discovery → filing · 11 weeks / 75 days

Mar 1, 2026

Discovered

May 15, 2026

Filed

vs. sector median

7 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed6 affectedView incident

Name: Town CPA, Nune Khachatrian, CPA, P.C
norm: town cpa nune khachatrian cpa

Name: Town CPA, Nune Khachatrian, CPA, P.C
norm: town cpa nune khachatrian cpa
Industry: Professional Servicesllm

Discovered: Mar 1, 2026
Materiality determined: —
Notification sent: May 15, 2026
Affected individuals: 6state-resident count only
Data types: Financial accountIdentity (basic)Government ID
Attack vector: Unknown
MITRE ATT&CK: T1078 Valid AccountsT1566 Phishing
Threat actor: ExternalFinancial
Regulator citations: Notified the IRSContacted state tax authorities

During the incident: Changed passwords
Isolated affected systems
Contacted the IRS and state tax authorities
Engaged data security and privacy professionals to assist in our response
Notified the IRS
Worked closely with tax authorities to share information
Implemented additional measures to enhance technical safeguards
Offering identity theft protection services through IDX
Changes made: Implemented additional measures to enhance technical safeguards
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 weeks(75 days from discovery to filing)
Compliance flags: MA AG >30d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.mass.gov/doc/2026-793-town-cpa-nune-khachatrian-cpa-pc/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 15, 2026
Raw hash: 59a8e7131aa4c353e5946254285cdf93f3c9261ed38e7a903fbc64809f468b9d

Reporting entityTown CPA, Nune Khachatrian, CPA, P.C

Victim entityTown CPA, Nune Khachatrian, CPA, P.C

Incidentdiscovered Mar 1, 2026

Stated responseChanged passwords

ComplianceMA AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.mass.gov